CVE-2024-10524

CWE-918 — Server-Side Request Forgery (SSRF)7 documents7 sources
Severity
6.5MEDIUM
EPSS
0.6%
top 30.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
GNU Wget
Timeline
PublishedNov 19

Description

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:LExploitability: 2.2 | Impact: 3.7

Affected Packages2 packages

▶CVEListV5gnu/wget< 1.25.0
▶Debianwget< 1.25.0-1+1

🔴Vulnerability Details

3
GHSA
GHSA-mqrm-h2pw-9j9r: Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable↗2024-11-19
▶
CVEList
GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs↗2024-11-19
▶
OSV
CVE-2024-10524: Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable↗2024-11-19
▶

📋Vendor Advisories

3
Red Hat
wget: GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs↗2024-11-19
▶
Microsoft
GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs↗2024-11-12
▶
Debian
CVE-2024-10524: wget - Applications that use Wget to access a remote resource using shorthand URLs and ...↗2024
▶