« Volver al listado

CVE-2024-10524

Estado: AplazadaMedia (6.5)—

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

GNU — WgetAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-10524",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-10524",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-19T15:19:46.827592Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "reefs@jfrog.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.7,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "reefs@jfrog.com",
      "affectedData": [
        {
          "vendor": "gnu",
          "product": "wget",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.25.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:gnu:wget:-:*:*:*:*:*:*:*"
          ],
          "vendor": "gnu",
          "product": "wget",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.25.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-11-19T15:15:06.740",
  "references": [
    {
      "url": "https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778",
      "source": "reefs@jfrog.com"
    },
    {
      "url": "https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/",
      "source": "reefs@jfrog.com"
    },
    {
      "url": "https://seclists.org/oss-sec/2024/q4/107",
      "source": "reefs@jfrog.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2024/11/18/6",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20250321-0007/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "reefs@jfrog.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host."
    },
    {
      "lang": "es",
      "value": "Las aplicaciones que utilizan Wget para acceder a un recurso remoto mediante URL abreviadas y pasan credenciales de usuario arbitrarias en la URL son vulnerables. En estos casos, los atacantes pueden introducir credenciales creadas que harán que Wget acceda a un host arbitrario."
    }
  ],
  "lastModified": "2026-06-17T06:55:51.610",
  "sourceIdentifier": "reefs@jfrog.com"
}