CVE-2024-10524
wget: GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · November 19, 2024
Updated · November 4, 2026
Description
A flaw was found in the Wget package. Wget might issue an FTP request to a different host in configurations where the HTTP shorthand format is used with user-provided input. An attacker may be able to use specially crafted input to cause Wget to access an arbitrary host.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
CWE-918 · Server-Side Request Forgery