p PatchFirst

CVE-2024-10524

CVE-2024-10524 · GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

CVSS 6.5 · Medium · EPSS 1.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • wget

    Versions
    • ≥ 0, < 1.25.0: Affected (custom)

    Update to 1.25.0

  • wget Debian:12

    Versions
    • 1.21.3-1
    • 1.21.3-1+deb12u1
    • 1.21.4-1
    • 1.24.5-1
    • 1.24.5-2
    • 1.25.0-1
    • 1.25.0-2
    • 1.25.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.25.0-1

    Update to 1.25.0-1

  • wget Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.25.0-1

    Update to 1.25.0-1

  • wget Ubuntu:Pro:14.04:LTS

    Versions
    • 1.14-2ubuntu1
    • 1.14-5ubuntu1
    • 1.15-1ubuntu1
    • 1.15-1ubuntu1.14.04.1
    • 1.15-1ubuntu1.14.04.2
    • 1.15-1ubuntu1.14.04.3
    • 1.15-1ubuntu1.14.04.4
    • 1.15-1ubuntu1.14.04.5
    • 1.15-1ubuntu1.14.04.5+esm2
    • 1.15-1ubuntu1.14.04.5+esm3
    • 1.15-1ubuntu1.14.04.5+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Ubuntu:Pro:16.04:LTS

    Versions
    • 1.16.1-1ubuntu1
    • 1.17.1-1ubuntu1
    • 1.17.1-1ubuntu1.1
    • 1.17.1-1ubuntu1.2
    • 1.17.1-1ubuntu1.3
    • 1.17.1-1ubuntu1.4
    • 1.17.1-1ubuntu1.5
    • 1.17.1-1ubuntu1.5+esm1
    • 1.17.1-1ubuntu1.5+esm3
    • 1.17.1-1ubuntu1.5+esm4
    • 1.17.1-1ubuntu1.5+esm5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Ubuntu:Pro:18.04:LTS

    Versions
    • 1.19.1-3ubuntu1
    • 1.19.1-3ubuntu1.1
    • 1.19.2-1ubuntu1
    • 1.19.3-2ubuntu1
    • 1.19.4-1ubuntu2
    • 1.19.4-1ubuntu2.1
    • 1.19.4-1ubuntu2.2
    • 1.19.4-1ubuntu2.2+esm1
    • 1.19.4-1ubuntu2.2+esm3
    • 1.19.4-1ubuntu2.2+esm4
    • 1.19.4-1ubuntu2.2+esm5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Ubuntu:Pro:20.04:LTS

    Versions
    • 1.20.3-1ubuntu1
    • 1.20.3-1ubuntu2
    • 1.20.3-1ubuntu2.1
    • 1.20.3-1ubuntu2.1+esm2
    • 1.20.3-1ubuntu2.1+esm3
    • 1.20.3-1ubuntu2.1+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Ubuntu:22.04:LTS

    Versions
    • 1.21-1ubuntu3
    • 1.21-1ubuntu4
    • 1.21-1ubuntu5
    • 1.21.2-2ubuntu1
    • 1.21.2-2ubuntu1.1
    • 1.21.2-2ubuntu1.3
    • 1.21.2-2ubuntu1.4
    • 1.21.2-2ubuntu1.5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Ubuntu:24.04:LTS

    Versions
    • 1.21.3-1ubuntu1
    • 1.21.4-1ubuntu1
    • 1.21.4-1ubuntu2
    • 1.21.4-1ubuntu3
    • 1.21.4-1ubuntu4
    • 1.21.4-1ubuntu4.1
    • 1.21.4-1ubuntu4.3
    • 1.21.4-1ubuntu4.4
    • 1.21.4-1ubuntu4.5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Ubuntu:25.10

    Versions
    • 1.24.5-2ubuntu1
    • 1.25.0-2ubuntu1
    • 1.25.0-2ubuntu2
    • 1.25.0-2ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →