Wget Vulnerability Affects Applications Using Shorthand URLs
CVE-2024-10524

6.5MEDIUM

Key Information:

Vendor
Gnu
Status
Wget
Vendor
CVE Published:
19 November 2024

Summary

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

Affected Version(s)

wget 0 < 1.25.0

References

https://seclists.org/oss-sec/2024/q4/107
vendor-advisory
https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulne...
third-party-advisory
https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c41...
patch

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.