FKIE_CVE-2024-10524

Vulnerability from fkie_nvd - Published: 2024-11-19 15:15 - Updated: 2025-03-21 18:15
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Summary
Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.
References
reefs@jfrog.comhttps://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778
reefs@jfrog.comhttps://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/
reefs@jfrog.comhttps://seclists.org/oss-sec/2024/q4/107
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/11/18/6
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20250321-0007/
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host."
    },
    {
      "lang": "es",
      "value": "Las aplicaciones que utilizan Wget para acceder a un recurso remoto mediante URL abreviadas y pasan credenciales de usuario arbitrarias en la URL son vulnerables. En estos casos, los atacantes pueden introducir credenciales creadas que har\u00e1n que Wget acceda a un host arbitrario."
    }
  ],
  "id": "CVE-2024-10524",
  "lastModified": "2025-03-21T18:15:32.323",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.7,
        "source": "reefs@jfrog.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-11-19T15:15:06.740",
  "references": [
    {
      "source": "reefs@jfrog.com",
      "url": "https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778"
    },
    {
      "source": "reefs@jfrog.com",
      "url": "https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/"
    },
    {
      "source": "reefs@jfrog.com",
      "url": "https://seclists.org/oss-sec/2024/q4/107"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2024/11/18/6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20250321-0007/"
    }
  ],
  "sourceIdentifier": "reefs@jfrog.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "reefs@jfrog.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.