GNU Wget Access List Bypass / Race Condition
Posted by deepcore on November 29, 2016 – 5:20 am
GNU wget versions 1.17 and earlier, when used in mirroring/recursive mode, are affected by a race condition vulnerability that might allow remote attackers to bypass intended wget access list restrictions specified with the -A parameter. This might allow attackers to place malicious/restricted files onto the system. Depending on the application / download directory, this could potentially lead to other vulnerabilities such as code execution, etc.
Post a reply
You must be logged in to post a comment.