CVEvulnerability
CVE-2024-10524
6.5 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2024-11-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
- Weaknesses
- CWE-918
Description
Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778 git.savannah.gnu.org
- https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/ jfrog.com
- https://seclists.org/oss-sec/2024/q4/107 seclists.org
- http://www.openwall.com/lists/oss-security/2024/11/18/6 www.openwall.com
- https://security.netapp.com/advisory/ntap-20250321-0007/ security.netapp.com