CVE-2024-10524 — GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs

CVE-2024-10524

GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs PUBLISHED

Description (CNA)

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

Affected (CNA)

Vendor / product	Versions
gnu / wget	affected 0 before 1.25.0

CWE

CWE-918

References

https://seclists.org/oss-sec/2024/q4/107
https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/
https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2024/11/18/6
https://security.netapp.com/advisory/ntap-20250321-0007/

CISA-ADP

No English description supplied.

No references supplied.