Critical severity · published Jun 16, 2024
CVE-2024-38428
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the…
9.1
CVSS
0.7%
EPSS
No
On KEV
Description
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WG
Wget · Gnu
through 1.24.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-38428
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-38428
Mailing List
https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242ace
Mailing List
https://lists.gnu.org/archive/html/bug-wget/2024-06/msg00005.html
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/04/msg00029.html
security.netapp.com
https://security.netapp.com/advisory/ntap-20241115-0005/
More from Wget
9.8
CVE-2019-5953
Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors
8.8
CVE-2017-13090
The retr.c:fd_read_body() function is called when processing OK responses
8.8
CVE-2017-13089
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects
8.8
CVE-2016-4971
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource
8.1
CVE-2016-7098
Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions…