CVE-2024-10524

medium

Description

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

References

https://seclists.org/oss-sec/2024/q4/107

https://security.netapp.com/advisory/ntap-20250321-0007/

https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/

https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778

http://www.openwall.com/lists/oss-security/2024/11/18/6

Details

Source: Mitre, NVD

Published: 2024-11-19

Updated: 2026-04-15

Risk Information

CVSS v2

Base Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:N

Severity: Medium

CVSS v3

Base Score: 6.5

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L