by Kastro
Paper/Archive/CVE-2024-38428

CVE-2024-38428

gnu wget — url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in…

EPSS 0.7%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (ADP, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 52.1.521 × 2010.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
wget< 1.24.51.24.5CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

reflists.gnu.org/archive/html/bug-wget/2024-06/msg00005.htmlrefgit.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242acerefsecurity.netapp.com/advisory/ntap-20241115-0005reflists.debian.org/debian-lts-announce/2025/04/msg00029.html