Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-38428

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

Published

2024-06-16T03:15:08.430

Last Modified

2025-04-21T10:15:14.207

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.1 (CRITICAL)

Weaknesses

Type: Primary
CWE-436
Type: Secondary
CWE-436

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	gnu	wget	≤ 1.24.5	Yes

References

https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242ace Mailing List, Patch ([email protected])
https://lists.gnu.org/archive/html/bug-wget/2024-06/msg00005.html Mailing List, Patch ([email protected])
https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242ace Mailing List, Patch (af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2025/04/msg00029.html (af854a3a-2127-422b-91ae-364da2661108)
https://lists.gnu.org/archive/html/bug-wget/2024-06/msg00005.html Mailing List, Patch (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20241115-0005/ (af854a3a-2127-422b-91ae-364da2661108)