{"api_version":"1","generated_at":"2026-07-23T10:30:18+00:00","cve":"CVE-2004-1488","urls":{"html":"https://cve.report/CVE-2004-1488","api":"https://cve.report/api/cve/CVE-2004-1488.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2004-1488","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2004-1488"},"summary":{"title":"CVE-2004-1488","description":"wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code.","state":"PUBLISHED","assigner":"mitre","published_at":"2005-04-27 04:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=261755","name":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=261755","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"],"title":"#261755 - wget: Server responses &c written to the tty verbatim (escape sequences, control characters, ...) - Debian Bug report logs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/20960","name":"http://secunia.com/advisories/20960","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Secunia - Advisories - SUSE Updates for Multiple Packages","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1012472","name":"http://securitytracker.com/id?1012472","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"wget Lets Remote Users Create or Overwrite Files in Certain Directories - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.redhat.com/support/errata/RHSA-2005-771.html","name":"http://www.redhat.com/support/errata/RHSA-2005-771.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://usn.ubuntu.com/145-1/","name":"https://usn.ubuntu.com/145-1/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"USN-145-1: wget vulnerabilities | Ubuntu security notices","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/11871","name":"http://www.securityfocus.com/bid/11871","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"],"title":"GNU WGet Multiple Remote Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.novell.com/linux/security/advisories/2006_16_sr.html","name":"http://www.novell.com/linux/security/advisories/2006_16_sr.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Announcement","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9750","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9750","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/18421","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/18421","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://marc.info/?l=bugtraq&m=110269474112384&w=2","name":"http://marc.info/?l=bugtraq&m=110269474112384&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2004-1488","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-1488","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2004","cve_id":"1488","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnu","cpe5":"wget","cpe6":"1.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2004","cve_id":"1488","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnu","cpe5":"wget","cpe6":"1.8.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2004","cve_id":"1488","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnu","cpe5":"wget","cpe6":"1.8.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2004","cve_id":"1488","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnu","cpe5":"wget","cpe6":"1.9","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2004","cve_id":"1488","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnu","cpe5":"wget","cpe6":"1.9.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T00:53:23.926Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"RHSA-2005:771","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://www.redhat.com/support/errata/RHSA-2005-771.html"},{"name":"11871","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/11871"},{"name":"20041209 wget: Arbitrary file overwriting/appending/creating and other vulnerabilities","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=110269474112384&w=2"},{"name":"USN-145-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"https://usn.ubuntu.com/145-1/"},{"name":"SUSE-SR:2006:016","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://www.novell.com/linux/security/advisories/2006_16_sr.html"},{"name":"wget-terminal-overwrite(18421)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/18421"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=261755"},{"name":"oval:org.mitre.oval:def:9750","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9750"},{"name":"20960","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/20960"},{"name":"1012472","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1012472"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2004-12-09T00:00:00.000Z","descriptions":[{"lang":"en","value":"wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-03T20:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"RHSA-2005:771","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://www.redhat.com/support/errata/RHSA-2005-771.html"},{"name":"11871","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/11871"},{"name":"20041209 wget: Arbitrary file overwriting/appending/creating and other vulnerabilities","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://marc.info/?l=bugtraq&m=110269474112384&w=2"},{"name":"USN-145-1","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"https://usn.ubuntu.com/145-1/"},{"name":"SUSE-SR:2006:016","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://www.novell.com/linux/security/advisories/2006_16_sr.html"},{"name":"wget-terminal-overwrite(18421)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/18421"},{"tags":["x_refsource_MISC"],"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=261755"},{"name":"oval:org.mitre.oval:def:9750","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9750"},{"name":"20960","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/20960"},{"name":"1012472","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1012472"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2004-1488","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"RHSA-2005:771","refsource":"REDHAT","url":"http://www.redhat.com/support/errata/RHSA-2005-771.html"},{"name":"11871","refsource":"BID","url":"http://www.securityfocus.com/bid/11871"},{"name":"20041209 wget: Arbitrary file overwriting/appending/creating and other vulnerabilities","refsource":"BUGTRAQ","url":"http://marc.info/?l=bugtraq&m=110269474112384&w=2"},{"name":"USN-145-1","refsource":"UBUNTU","url":"https://usn.ubuntu.com/145-1/"},{"name":"SUSE-SR:2006:016","refsource":"SUSE","url":"http://www.novell.com/linux/security/advisories/2006_16_sr.html"},{"name":"wget-terminal-overwrite(18421)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/18421"},{"name":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=261755","refsource":"MISC","url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=261755"},{"name":"oval:org.mitre.oval:def:9750","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9750"},{"name":"20960","refsource":"SECUNIA","url":"http://secunia.com/advisories/20960"},{"name":"1012472","refsource":"SECTRACK","url":"http://securitytracker.com/id?1012472"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2004-1488","datePublished":"2005-02-15T05:00:00.000Z","dateReserved":"2005-02-15T00:00:00.000Z","dateUpdated":"2024-08-08T00:53:23.926Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2005-04-27 04:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gnu:wget:1.8:*:*:*:*:*:*:*","matchCriteriaId":"D5BF2616-A99A-4229-A8A6-655155ED5EB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnu:wget:1.8.1:*:*:*:*:*:*:*","matchCriteriaId":"3A14454E-DDAE-4115-8323-8BB4E17DF208"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnu:wget:1.8.2:*:*:*:*:*:*:*","matchCriteriaId":"94E758F9-798B-4C25-A94A-8BF4E3E90B3E"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnu:wget:1.9:*:*:*:*:*:*:*","matchCriteriaId":"F88CD81A-7804-4316-8581-41689A318D56"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnu:wget:1.9.1:*:*:*:*:*:*:*","matchCriteriaId":"1BE0FCE2-ABB9-4943-96AE-C81277014396"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2004","CveId":"1488","Ordinal":"1","Title":"CVE-2004-1488","CVE":"CVE-2004-1488","Year":"2004"},"notes":[{"CveYear":"2004","CveId":"1488","Ordinal":"1","NoteData":"wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code.","Type":"Description","Title":"CVE-2004-1488"},{"CveYear":"2004","CveId":"1488","Ordinal":"2","NoteData":"2005-02-15","Type":"Other","Title":"Published"},{"CveYear":"2004","CveId":"1488","Ordinal":"3","NoteData":"2018-10-03","Type":"Other","Title":"Modified"}]}}}