CVE-2018-20483: Infoleak
Last updated 25 August 2025
Other sources
setfilemetadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwritexattr in toolxattr.c in curl.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-20483?
CVE-2018-20483 is a vulnerability in GNU Wget before version 1.20.1 that allows local users to obtain sensitive information by reading the user.xdg.origin.url metadata attribute of downloaded files.
How does CVE-2018-20483 affect GNU Wget?
CVE-2018-20483 affects GNU Wget versions before 1.20.1.
What is the severity of CVE-2018-20483?
CVE-2018-20483 has a severity rating of 7.8, which is considered high.
How can I fix the CVE-2018-20483 vulnerability in GNU Wget?
To fix the CVE-2018-20483 vulnerability, update GNU Wget to version 1.20.1 or later.
Where can I find more information about CVE-2018-20483?
You can find more information about CVE-2018-20483 at the following references: [1] http://git.savannah.gnu.org/cgit/wget.git/tree/NEWS [2] http://www.securityfocus.com/bid/106358 [3] https://access.redhat.com/errata/RHSA-2019:3701