Search for vulnerabilities
| Vulnerability ID | VCID-6hyy-mdcx-wbdc |
| Aliases |
CVE-2014-4877
|
| Summary | |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 3.8 |
| Risk | 7.6 |
| Affected and Fixed Packages | Package Details |
| Data source | Metasploit |
|---|---|
| Description | This module exploits a vulnerability in Wget when used in recursive (-r) mode with a FTP server as a destination. A symlink is used to allow arbitrary writes to the target's filesystem. To specify content for the file, use the "file:/path" syntax for the TARGET_DATA option. Tested successfully with wget 1.14. Versions prior to 1.16 are presumed vulnerable. |
| Note | {}
|
| Ransomware campaign use | Unknown |
| Source publication date | Oct. 27, 2014 |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/server/wget_symlink_file_write.rb |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
| Percentile | 0.9857 |
| EPSS Score | 0.69365 |
| Published At | July 30, 2025, 12:55 p.m. |
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| 2025-07-31T08:40:01.932149+00:00 | Ubuntu USN Importer | Import | https://usn.ubuntu.com/2393-1/ | 37.0.0 |