CVE-1999-0402
MediumExploitation Probability (EPSS)
Elevated risk70th percentile - higher than 70% of all known CVEs
Summary
Version 1.5.3 of wget follows symlinks, leading to permission changes on the target file instead of the symlink itself.
Risk Assessment
This may result in unauthorized changes to file permissions, posing a risk to system integrity.
Recommendation
It is recommended to update wget to a newer version that does not have this vulnerability.
Other vulnerabilities in wget 1.5.3
See all- CVE-2017-13090High
The retr.c:fd_read_body() function processes OK responses, but in wget versions before 1.19.2, it does not check the length of chunks, which can lead to passing a negative value to fd_read(). This allows an attacker to control the length argument, potentially corrupting malloc metadata.
- CVE-2017-13089High
The http.c:skip_short_body() function in wget before version 1.19.2 does not check the length of response chunks, which can lead to passing a negative value to the fd_read() function. This creates an opportunity for an attacker to control the length argument.
- CVE-2016-7098High
A race condition in wget 1.17 and earlier may allow remote servers to bypass intended access list restrictions when downloading a single file in recursive or mirroring mode.
Original NVD description (English source)
wget 1.5.3 follows symlinks to change permissions of the target file instead of the symlink itself.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS