CVE-2004-1946

CVE-2004-1946 describes a format string vulnerability in the PRINT_ERROR function of Cherokee Web Server versions 0.4.16 and earlier. This flaw allows local users to execute arbitrary code by injecting format string specifiers into the -C command line argument. The vulnerability has a CVSS score of 4.6, indicating a medium severity. It requires local access (AV:L) with low attack complexity (AC:L) and no authentication (Au:N), potentially leading to partial confidentiality, integrity, and availability impacts (C:P/I:P/A:P). The exploitability of this issue remotely or with escalated privileges is unclear, which might reduce its overall impact. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Despite this, the CVE has garnered significant community discussion with 10 mentions, suggesting some level of awareness or interest, though it lacks media coverage.