{"id":"CVE-2018-20483","aliases":["ALPINE-CVE-2018-20483","BELL-CVE-2018-20483","DEBIAN-CVE-2018-20483","EUVD-2018-13037","GHSA-mxm6-6r3r-6wj4","MGASA-2019-0015","RHSA-2019:3701","SUSE-SU-2019:0093-1","UBUNTU-CVE-2018-20483","USN-3943-1","openSUSE-SU-2019:0057-1","openSUSE-SU-2024:11510-1"],"status":"published","title":"set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg...","description":"set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00659,"percentile":0.51811,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2018-12-26T00:00:00Z","modified":"2026-10-23T18:03:56Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"wget","fixed_in":["1.20.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"wget","fixed_in":["1.20.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wget","fixed_in":["1.20.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wget","fixed_in":["1.20.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"wget","fixed_in":["1.20.1-1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"wget","fixed_in":["1.19.5-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"wget","fixed_in":["1.19.4-1ubuntu2.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"wget","fixed_in":["1.19.5-lp150.2.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-1.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4-1ubuntu2.2"}]}],"versions":["1.19.1-3ubuntu1","1.19.1-3ubuntu1.1","1.19.2-1ubuntu1","1.19.3-2ubuntu1","1.19.4-1ubuntu2","1.19.4-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-1ubuntu1.14.04.5"}]}],"versions":["1.14-2ubuntu1","1.14-5ubuntu1","1.15-1ubuntu1","1.15-1ubuntu1.14.04.1","1.15-1ubuntu1.14.04.2","1.15-1ubuntu1.14.04.3","1.15-1ubuntu1.14.04.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1ubuntu1.5"}]}],"versions":["1.16.1-1ubuntu1","1.17.1-1ubuntu1","1.17.1-1ubuntu1.1","1.17.1-1ubuntu1.2","1.17.1-1ubuntu1.3","1.17.1-1ubuntu1.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4-1ubuntu2.2"}]}],"versions":["1.19.1-3ubuntu1","1.19.1-3ubuntu1.1","1.19.2-1ubuntu1","1.19.3-2ubuntu1","1.19.4-1ubuntu2","1.19.4-1ubuntu2.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-lp150.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-2.2"}]}],"bundled":7}],"products":[{"vendor":"gnu","product":"wget"}],"references":[{"url":"https://security.gentoo.org/glsa/201903-08","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/106358","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://twitter.com/marcan42/status/1077676739877232640","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"http://git.savannah.gnu.org/cgit/wget.git/tree/NEWS","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","article","report"]},{"url":"https://security.netapp.com/advisory/ntap-20190321-0002/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://usn.ubuntu.com/3943-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3701","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20483","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mxm6-6r3r-6wj4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-20483","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-20483","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-20483","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0015.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24109","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2019/01/01/1","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1662705","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670252","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670256","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3701.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-16890","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16890","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16890","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/CVE-2018-16890.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20483","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20483","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3822","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3822","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3822","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/CVE-2019-3822.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3823","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3823","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/CVE-2019-3823.html","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190093-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1120382","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20483","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-20483","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3943-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-5953","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VQB3VGM73MWXA3OQFWL4UK2Z2IBTZMIT/#VQB3VGM73MWXA3OQFWL4UK2Z2IBTZMIT","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-6719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5953","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-20483","description":"set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.","status":"published","published":"2018-12-26T18:00:00Z","modified":"2024-08-05T12:05:16.988Z","updated_at":"2026-11-02T14:34:59.872731Z"}],"euvd":[{"id":"EUVD-2018-13037","description":"set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.","status":"published","published":"2018-12-26T18:00:00Z","modified":"2024-08-05T12:05:16Z","updated_at":"2026-11-03T02:39:30.889297Z"}],"ghsa":[{"id":"GHSA-mxm6-6r3r-6wj4","title":"set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg...","description":"set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.","status":"published","published":"2022-05-13T01:19:55Z","modified":"2023-02-01T05:06:06Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:50:19.146831Z"}],"nvd":[{"id":"CVE-2018-20483","description":"set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.","status":"published","published":"2018-12-26T18:29:00.48Z","modified":"2026-06-17T01:52:56.673Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:04:52.056758Z"}],"osv":[{"id":"ALPINE-CVE-2018-20483","description":"set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.","status":"published","published":"2018-12-26T18:29:00.48Z","modified":"2026-10-23T17:17:55.249854826Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2018-20483","title":"CVE-2018-20483 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:00.657269Z","modified":"2026-01-26T09:48:34.050632Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-20483","description":"set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.","status":"published","published":"2018-12-26T18:29:00.48Z","modified":"2026-04-16T06:17:28.193520853Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"DEBIAN-CVE-2018-20483","description":"set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.","status":"published","published":"2018-12-26T18:29:00.48Z","modified":"2026-10-23T18:03:56.797833198Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"RHSA-2019:3701","title":"Red Hat Security Advisory: curl security and bug fix update","status":"published","published":"2024-09-16T02:32:05Z","modified":"2026-09-21T10:02:23Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2018-20483","description":"set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.","status":"published","published":"2018-12-26T00:00:00Z","modified":"2026-02-04T03:04:28.842768Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"MGASA-2019-0015","title":"Updated wget packages fix security vulnerability","description":"Since version 1.19 Wget stores the URL and in certain cases the\n'Referer' URL within extended attributes (xattrs) of the file system\n- by default.\nThis includes username + password and other credentials or private data\n*if* those have been used within the URLs. Anyone with read access to\nthose files might also read the xattrs and might use the data.\nWget 1.20.1 or higher will not use xattrs by default any more. To enable\nit again you have to use the --xattr option or xattr command for .wgetrc\nfiles. (CVE-2018-20483)\n","status":"published","published":"2019-01-05T21:49:27Z","modified":"2026-04-16T06:26:30.126600313Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:0057-1","title":"Security update for wget","description":"This update for wget fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-20483: Fixed an information disclosure through file metadata (bsc#1120382)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T10:47:55Z","modified":"2026-02-04T04:18:11.384525Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:11510-1","title":"wget-1.21.1-2.2 on GA media","description":"These are all security issues fixed in the wget-1.21.1-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:17:43.041338Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2019:0093-1","title":"Security update for wget","description":"This update for wget fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-20483: Fixed an information disclosure through file metadata (bsc#1120382)\n","status":"published","published":"2019-01-15T13:48:37Z","modified":"2026-02-04T04:33:10.948857Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3943-1","title":"wget vulnerabilities","description":"It was discovered that Wget incorrectly handled certain inputs.\nAn attacker could possibly use this issue to access sensitive\ninformation. This issue only affected Ubuntu 18.04 LTS and\nUbuntu 18.10. (CVE-2018-20483)\n\nKusano Kazuhiko discovered that Wget incorrectly handled certain inputs.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2019-5953)\n","status":"published","published":"2019-04-08T23:52:29Z","modified":"2026-02-10T04:41:31Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}