CVE-2024-10524: GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs
Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10524?
CVE-2024-10524 is considered a significant vulnerability due to potential data exposure through remote resource access with crafted URLs.
How do I fix CVE-2024-10524?
To fix CVE-2024-10524, ensure you update Wget to the latest version where this vulnerability has been patched by the maintainers.
Who is affected by CVE-2024-10524?
CVE-2024-10524 affects any applications that utilize Wget to access remote resources with shorthand URLs that involve arbitrary user credentials.
What types of attacks can be performed using CVE-2024-10524?
Using CVE-2024-10524, attackers can exploit the vulnerability to access arbitrary hosts by crafting malicious credentials in the URL.
Is CVE-2024-10524 easy to exploit?
Yes, CVE-2024-10524 can be easily exploited by attackers who are knowledgeable about how Wget processes URLs with user credentials.