CVE-2024-10524 | BDVDB-2026-255758 Detail
gnuwget
Description#
Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact low. Attack vector: network.
Weaknesses#
- CWE-918 Server-Side Request Forgery (SSRF)
References#
- https://seclists.org/oss-sec/2024/q4/107
- https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/
- https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778
- http://www.openwall.com/lists/oss-security/2024/11/18/6
- https://security.netapp.com/advisory/ntap-20250321-0007/
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.