{"id":"CVE-2024-10524","aliases":["ALPINE-CVE-2024-10524","AZL-53235","BELL-CVE-2024-10524","DEBIAN-CVE-2024-10524","EUVD-2024-33431","GHSA-mqrm-h2pw-9j9r","JLSEC-2026-119","MGASA-2024-0378","OESA-2024-2497","ROOT-OS-ALPINE-318-CVE-2024-10524","ROOT-OS-ALPINE-319-CVE-2024-10524","ROOT-OS-ALPINE-320-CVE-2024-10524","ROOT-OS-DEBIAN-11-CVE-2024-10524","ROOT-OS-DEBIAN-12-CVE-2024-10524","SUSE-SU-2024:4138-1","SUSE-SU-2024:4145-1","SUSE-SU-2025:01921-1","SUSE-SU-2025:20097-1","SUSE-SU-2025:20325-1","SUSE-SU-2026:3148-1","UBUNTU-CVE-2024-10524","openSUSE-SU-2024:14492-1"],"status":"published","title":"GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs","description":"Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01071,"percentile":0.65325,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2024-11-13T00:00:00Z","modified":"2026-11-02T12:00:53Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"wget","fixed_in":["1.25.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"wget","fixed_in":["1.25.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"wget","fixed_in":["1.25.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"wget","fixed_in":["1.25.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"wget","fixed_in":["1.21.2-4"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"wget","fixed_in":["1.21.4-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"wget","fixed_in":["1.25.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wget","fixed_in":["1.25.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wget","fixed_in":["1.25.0-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"wget_jll","fixed_in":["1.25.0+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"wget","fixed_in":["1.21.4-1.2.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"wget","fixed_in":["1.21.2-6.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"wget","fixed_in":["1.20.3-6.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"wget","fixed_in":["1.21.2-6.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"wget","fixed_in":["1.21.4-3.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"wget","fixed_in":["1.21.2-6.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.18","package":"rootio-wget","fixed_in":["1.21.4-r00071"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.19","package":"rootio-wget","fixed_in":["1.21.4-r00071"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-wget","fixed_in":["1.24.5-r00071"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"wget","fixed_in":["1.21-1+deb11u2.aikido.14","1.21-1+deb11u2.aikido.15","1.21-1+deb11u2.root.io.12","1.21-1+deb11u2.root.io.13","1.21-1+deb11u2.root.io.10","1.21-1+deb11u2.root.io.11"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-wget","fixed_in":["1.21-1+deb11u2.aikido.14","1.21-1+deb11u2.aikido.15","1.21-1+deb11u2.root.io.12","1.21-1+deb11u2.root.io.13","1.21-1+deb11u2.root.io.10","1.21-1+deb11u2.root.io.11"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"wget","fixed_in":["1.21.3-1+deb12u1.root.io.1","1.21.3-1+deb12u1.aikido.5","1.21.3-1+deb12u1.root.io.2","1.21.3-1+deb12u1.root.io.3","1.21.3-1+deb12u1.root.io.4","1.21.3-1+deb12u1.aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-wget","fixed_in":["1.21.3-1+deb12u1.root.io.1","1.21.3-1+deb12u1.aikido.5","1.21.3-1+deb12u1.root.io.2","1.21.3-1+deb12u1.root.io.3","1.21.3-1+deb12u1.root.io.4","1.21.3-1+deb12u1.aikido.6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"wget","fixed_in":["1.20.3-150000.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"wget","fixed_in":["1.20.3-150000.3.26.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"wget","fixed_in":["1.20.3-150000.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"wget","fixed_in":["1.20.3-150600.19.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"wget","fixed_in":["1.20.3-150600.19.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"wget","fixed_in":["1.14-21.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"wget","fixed_in":["1.24.5-2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"wget","fixed_in":["1.24.5-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"wget","fixed_in":["1.25.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-4"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.21.3-r2"},{"fixed":"1.21.4-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.21.3-r2"},{"fixed":"1.25.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-1","1.21.3-1+deb12u1","1.21.4-1","1.24.5-1","1.24.5-2","1.25.0-1","1.25.0-2","1.25.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"wget_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.25.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-1.2.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-6.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-6.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-6.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-3.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-6.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.18","package":"rootio-wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-r00071"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.19","package":"rootio-wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-r00071"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.5-r00071"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21-1+deb11u2.aikido.14"},{"fixed":"1.21-1+deb11u2.aikido.15"},{"fixed":"1.21-1+deb11u2.root.io.12"},{"fixed":"1.21-1+deb11u2.root.io.13"},{"fixed":"1.21-1+deb11u2.root.io.10"},{"fixed":"1.21-1+deb11u2.root.io.11"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21-1+deb11u2.aikido.14"},{"fixed":"1.21-1+deb11u2.aikido.15"},{"fixed":"1.21-1+deb11u2.root.io.12"},{"fixed":"1.21-1+deb11u2.root.io.13"},{"fixed":"1.21-1+deb11u2.root.io.10"},{"fixed":"1.21-1+deb11u2.root.io.11"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.3-1+deb12u1.root.io.1"},{"fixed":"1.21.3-1+deb12u1.aikido.5"},{"fixed":"1.21.3-1+deb12u1.root.io.2"},{"fixed":"1.21.3-1+deb12u1.root.io.3"},{"fixed":"1.21.3-1+deb12u1.root.io.4"},{"fixed":"1.21.3-1+deb12u1.aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.3-1+deb12u1.root.io.1"},{"fixed":"1.21.3-1+deb12u1.aikido.5"},{"fixed":"1.21.3-1+deb12u1.root.io.2"},{"fixed":"1.21.3-1+deb12u1.root.io.3"},{"fixed":"1.21.3-1+deb12u1.root.io.4"},{"fixed":"1.21.3-1+deb12u1.aikido.6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150000.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150000.3.26.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150000.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150600.19.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150600.19.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.5-2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.5-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.5-150700.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14-2ubuntu1","1.14-5ubuntu1","1.15-1ubuntu1","1.15-1ubuntu1.14.04.1","1.15-1ubuntu1.14.04.2","1.15-1ubuntu1.14.04.3","1.15-1ubuntu1.14.04.4","1.15-1ubuntu1.14.04.5","1.15-1ubuntu1.14.04.5+esm2","1.15-1ubuntu1.14.04.5+esm3","1.15-1ubuntu1.14.04.5+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-1ubuntu1","1.17.1-1ubuntu1","1.17.1-1ubuntu1.1","1.17.1-1ubuntu1.2","1.17.1-1ubuntu1.3","1.17.1-1ubuntu1.4","1.17.1-1ubuntu1.5","1.17.1-1ubuntu1.5+esm1","1.17.1-1ubuntu1.5+esm3","1.17.1-1ubuntu1.5+esm4","1.17.1-1ubuntu1.5+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.1-3ubuntu1","1.19.1-3ubuntu1.1","1.19.2-1ubuntu1","1.19.3-2ubuntu1","1.19.4-1ubuntu2","1.19.4-1ubuntu2.1","1.19.4-1ubuntu2.2","1.19.4-1ubuntu2.2+esm1","1.19.4-1ubuntu2.2+esm3","1.19.4-1ubuntu2.2+esm4","1.19.4-1ubuntu2.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu1","1.20.3-1ubuntu2","1.20.3-1ubuntu2.1","1.20.3-1ubuntu2.1+esm2","1.20.3-1ubuntu2.1+esm3","1.20.3-1ubuntu2.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21-1ubuntu3","1.21-1ubuntu4","1.21-1ubuntu5","1.21.2-2ubuntu1","1.21.2-2ubuntu1.1","1.21.2-2ubuntu1.3","1.21.2-2ubuntu1.4","1.21.2-2ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-1ubuntu1","1.21.4-1ubuntu1","1.21.4-1ubuntu2","1.21.4-1ubuntu3","1.21.4-1ubuntu4","1.21.4-1ubuntu4.1","1.21.4-1ubuntu4.3","1.21.4-1ubuntu4.4","1.21.4-1ubuntu4.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.5-2ubuntu1","1.25.0-2ubuntu1","1.25.0-2ubuntu2","1.25.0-2ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-1.1"}]}]}],"products":[{"vendor":"gnu","product":"wget"}],"references":[{"url":"https://seclists.org/oss-sec/2024/q4/107","tags":["vendor-advisory","advisory","web"]},{"url":"https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/","tags":["third-party-advisory","advisory","web","report"]},{"url":"https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778","tags":["patch","fix","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/11/18/6","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20250321-0007/","tags":["advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10524","tags":["web","advisory"]},{"url":"https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20250321-0007","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mqrm-h2pw-9j9r","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-10524","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-10524","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10524.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-10524","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0378.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33780","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/11/18/6","tags":["web","report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2497","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244138-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1233773","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10524","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244145-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501921-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520097-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520325-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263148-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271033","tags":["report"]},{"url":"https://bugzilla.suse.com/1271034","tags":["report"]},{"url":"https://bugzilla.suse.com/1271035","tags":["report"]},{"url":"https://bugzilla.suse.com/1271036","tags":["report"]},{"url":"https://bugzilla.suse.com/1271320","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58472","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-10524","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-10524","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EBDIZKQRGYQMJYWWQYJZJ4APTZPL6S4K/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-10524","title":"GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs","description":"Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.","status":"published","published":"2024-11-19T14:23:09.718Z","modified":"2025-03-21T18:03:44.339Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:34:02.321514Z"}],"euvd":[{"id":"EUVD-2024-33431","description":"Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.","status":"published","published":"2024-11-19T14:23:09Z","modified":"2025-03-21T18:03:44Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:56.049523Z"}],"ghsa":[{"id":"GHSA-mqrm-h2pw-9j9r","title":"Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary...","description":"Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.","status":"published","published":"2024-11-19T15:31:54Z","modified":"2025-03-21T18:32:31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:00:24.265228Z"}],"nvd":[{"id":"CVE-2024-10524","description":"Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.","status":"published","published":"2024-11-19T15:15:06.74Z","modified":"2026-06-17T06:55:51.61Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:10:37.632431Z"}],"osv":[{"id":"ALPINE-CVE-2024-10524","description":"Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.","status":"published","published":"2024-11-19T15:15:06.74Z","modified":"2026-11-02T11:17:50.050879318Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-10524","status":"published","published":"2024-11-20T05:59:44.288969Z","modified":"2026-01-26T09:42:47.744522Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-10524","title":"GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs","description":"Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.","status":"published","published":"2024-11-19T14:23:09.718Z","modified":"2026-11-08T10:45:10.500357277Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2024-10524","description":"Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.","status":"published","published":"2024-11-19T15:15:06.74Z","modified":"2026-11-02T12:00:53.12982056Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"JLSEC-2026-119","title":"Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user...","description":"Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.","status":"published","published":"2026-04-15T20:29:47.271Z","modified":"2026-07-25T18:23:54.013611028Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2024-2497","title":"wget security update","description":"GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc.\r\n\r\nSecurity Fix(es):\r\n\r\nApplications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.(CVE-2024-10524)","status":"published","published":"2024-12-06T11:07:58Z","modified":"2026-08-18T01:18:41.673622489Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"UBUNTU-CVE-2024-10524","description":"Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.","status":"published","published":"2024-11-19T15:15:00Z","modified":"2026-08-21T05:02:13.079682609Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"AZL-53235","title":"CVE-2024-10524 affecting package wget for versions less than 1.21.2-4","description":"Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.","status":"published","published":"2024-11-19T15:15:06Z","modified":"2026-04-21T04:33:39.038521Z","updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"MGASA-2024-0378","title":"Updated wget packages fix security vulnerability","description":"Applications that use Wget to access a remote resource using shorthand\nURLs and pass arbitrary user credentials in the URL are vulnerable. In\nthese cases attackers can enter crafted credentials which will cause\nWget to access an arbitrary host. (CVE-2024-10524)\n","status":"published","published":"2024-11-27T19:59:10Z","modified":"2026-04-16T04:42:53.441129786Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14492-1","title":"wget-1.25.0-1.1 on GA media","description":"These are all security issues fixed in the wget-1.25.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-13T00:00:00Z","modified":"2026-02-04T02:30:52.045447Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"ROOT-OS-ALPINE-318-CVE-2024-10524","title":"CVE-2024-10524 in rootio-wget - Patched by Root","description":"Root has patched CVE-2024-10524 in the rootio-wget package for Root:Alpine:3.18. Multiple fixed versions available.","status":"published","published":"2025-08-12T08:23:12Z","modified":"2026-02-13T03:24:03.469061Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-ALPINE-319-CVE-2024-10524","title":"CVE-2024-10524 in rootio-wget - Patched by Root","description":"Root has patched CVE-2024-10524 in the rootio-wget package for Root:Alpine:3.19. Multiple fixed versions available.","status":"published","published":"2025-08-12T08:23:12Z","modified":"2026-02-13T03:15:38.677899Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2024-10524","title":"CVE-2024-10524 in rootio-wget - Patched by Root","description":"Root has patched CVE-2024-10524 in the rootio-wget package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2025-08-12T08:23:12Z","modified":"2026-02-13T03:21:26.102631Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2024-10524","title":"CVE-2024-10524 in wget - Patched by Root","description":"Root has patched CVE-2024-10524 in the wget package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-23T08:19:34Z","modified":"2026-08-23T10:19:47.261440691Z","updated_at":"2026-11-02T15:53:28.80888Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2024-10524","title":"CVE-2024-10524 in wget - Patched by Root","description":"Root has patched CVE-2024-10524 in the wget package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-07T07:28:44Z","modified":"2026-10-07T08:15:07.877130875Z","updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"SUSE-SU-2024:4138-1","title":"Security update for wget","description":"This update for wget fixes the following issues:\n\n- CVE-2024-10524: Fixed SSRF via shorthand HTTP URL (bsc#1233773)\n","status":"published","published":"2024-12-02T12:29:59Z","modified":"2026-02-04T02:41:36.02867Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2024:4145-1","title":"Security update for wget","description":"This update for wget fixes the following issues:\n\n- CVE-2024-10524: Fixed SSRF via shorthand HTTP URL (bsc#1233773)\n","status":"published","published":"2024-12-03T09:07:29Z","modified":"2026-02-04T04:17:31.639443Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01921-1","title":"Security update for wget","description":"This update for wget fixes the following issues:\n\n - CVE-2024-10524: Dropped support for shorthand URLs that enabled SSRF attacks (bsc#1233773).\n","status":"published","published":"2025-06-12T06:29:35Z","modified":"2026-02-04T03:39:02.703882Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:20097-1","title":"Security update for wget","description":"This update for wget fixes the following issues:\n\n- CVE-2024-10524: Drop support for shorthand URLs (bsc#1233773).\n","status":"published","published":"2025-02-03T09:14:10Z","modified":"2026-03-23T04:47:08.154524Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20325-1","title":"Security update for wget","description":"This update for wget fixes the following issues:\n\n- CVE-2024-10524: Drop support for shorthand URLs (bsc#1233773).\n","status":"published","published":"2025-05-15T09:44:44Z","modified":"2026-03-23T04:50:46.395416Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2026:3148-1","title":"Security update for wget","description":"This update for wget fixes the following issues:\n\n- CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery (bsc#1271320).\n- CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread (bsc#1271033).\n- CVE-2026-58470: server-controlled values can cause an integer overflow in parse_content_range() (bsc#1271034).\n- CVE-2026-58471: server-supplied filenames requiring character set conversion could lead to heap memory corruption\n  (bsc#1271035).\n- CVE-2026-58472: crafted HTML attribute with a large number of characters can lead to a heap buffer overflow\n  (bsc#1271036).\n","status":"published","published":"2026-07-21T12:44:59Z","modified":"2026-07-22T09:30:07.599912002Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}