url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade wget | Aug 22, 2024 | Jun 16, 2024 |
| Amazon_linux_2023 | — | Upgrade wget-debugsourceUpgrade wget-debuginfoUpgrade wget | Feb 17, 2025 | Jun 1, 2024 |
| Debian | — | Upgrade wget | Mar 17, 2025 | Jun 16, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade wget | Oct 8, 2024 | Jun 16, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade wget | Oct 9, 2024 | Jun 16, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade wget | Jan 21, 2025 | Jun 16, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade wget | Oct 8, 2024 | Jun 16, 2024 |
| Oracle_linux | — | Upgrade wget | Oct 16, 2024 | Jun 1, 2024 |
| Redhat_linux | — | Upgrade wget-debugsourceUpgrade wget-debuginfoUpgrade wgetNo solution exists | Sep 6, 2024 | Jun 16, 2024 |
| Rocky_linux | — | Upgrade wget-debuginfoUpgrade wget-debugsourceUpgrade wget | May 8, 2025 | Jun 16, 2024 |
| Suse | — | Upgrade wget-langUpgrade wget | Jun 24, 2024 | Jun 16, 2024 |
| Ubuntu | — | Upgrade wget (Ubuntu Pro)Upgrade wget | Jul 3, 2024 | Jun 16, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub