CVE catalog

CVE-2018-20483

wget: CVE-2018-20483

[CVE catalog]

Severity
Medium · CVSS 6.2CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.66% · Oct 25, 2026

set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianwgetsid1.25.0-3fixed
Debianwgetforky1.25.0-3fixed
Debianwgettrixie1.25.0-2fixed
Debianwgetbookworm1.21.3-1+deb12u1fixed
Alpinewget3.101.20.1-r0fixed
Alpinewget3.111.20.1-r0fixed
Alpinewget3.121.20.1-r0fixed
Alpinewget3.131.20.1-r0fixed
Alpinewget3.141.20.1-r0fixed
Alpinewget3.151.20.1-r0fixed
Alpinewget3.161.20.1-r0fixed
Alpinewget3.171.20.1-r0fixed
Alpinewget3.181.20.1-r0fixed
Alpinewget3.191.20.1-r0fixed
Alpinewget3.201.20.1-r0fixed
Alpinewget3.211.20.1-r0fixed
Alpinewget3.221.20.1-r0fixed
Alpinewget3.231.20.1-r0fixed
Alpinewget3.241.20.1-r0fixed
Alpinewget3.61.20.1-r0fixed
Alpinewget3.71.20.1-r0fixed
Alpinewget3.81.20.1-r0fixed
Alpinewget3.91.20.1-r0fixed
Ubuntuwget14.041.14-2ubuntu1vulnerable
Ubuntuwget14.041.14-5ubuntu1vulnerable
Ubuntuwget14.041.15-1ubuntu1vulnerable
Ubuntuwget14.041.15-1ubuntu1.14.04.1vulnerable
Ubuntuwget14.041.15-1ubuntu1.14.04.2vulnerable
Ubuntuwget14.041.15-1ubuntu1.14.04.3vulnerable
Ubuntuwget14.041.15-1ubuntu1.14.04.4vulnerable
Ubuntuwget14.041.15-1ubuntu1.14.04.5fixed
Ubuntuwget16.041.16.1-1ubuntu1vulnerable
Ubuntuwget16.041.17.1-1ubuntu1vulnerable
Ubuntuwget16.041.17.1-1ubuntu1.1vulnerable
Ubuntuwget16.041.17.1-1ubuntu1.2vulnerable
Ubuntuwget16.041.17.1-1ubuntu1.3vulnerable
Ubuntuwget16.041.17.1-1ubuntu1.4vulnerable
Ubuntuwget16.041.17.1-1ubuntu1.5fixed
Ubuntuwget18.041.19.1-3ubuntu1vulnerable
Ubuntuwget18.041.19.1-3ubuntu1.1vulnerable
Ubuntuwget18.041.19.2-1ubuntu1vulnerable
Ubuntuwget18.041.19.3-2ubuntu1vulnerable
Ubuntuwget18.041.19.4-1ubuntu2vulnerable
Ubuntuwget18.041.19.4-1ubuntu2.1vulnerable
Ubuntuwget18.041.19.4-1ubuntu2.2fixed
Susewgetlinux enterprise module for basesystem 151.19.5-3.3.1fixed
Opensusewgetleap 15.01.19.5-lp150.2.3.1fixed
Ubuntuwget18.041.19.1-3ubuntu1vulnerable
Ubuntuwget18.041.19.1-3ubuntu1.1vulnerable
Ubuntuwget18.041.19.2-1ubuntu1vulnerable
Ubuntuwget18.041.19.3-2ubuntu1vulnerable
Ubuntuwget18.041.19.4-1ubuntu2vulnerable
Ubuntuwget18.041.19.4-1ubuntu2.1vulnerable
Ubuntuwget18.041.19.4-1ubuntu2.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianwgetsourcesid1.20.1-1not yet assignedNot reported[917375]
Debianwgetsourceforky1.20.1-1not yet assignedNot reported[917375]
Debianwgetsourcetrixie1.20.1-1not yet assignedNot reported[917375]
Debianwgetsourcebookworm1.20.1-1not yet assignedNot reported[917375]
Alpinewgetapk3.101.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.111.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.121.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.131.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.141.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.151.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.161.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.171.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.181.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.191.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.201.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.211.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.221.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.231.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.241.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.61.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.71.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.81.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Alpinewgetapk3.91.20.1-r0Not reportedALPINE-CVE-2018-20483Not reported
Ubuntuwgetdeb14.041.15-1ubuntu1.14.04.5Not reportedUSN-3943-1Not reported
Ubuntuwgetdeb16.041.17.1-1ubuntu1.5Not reportedUSN-3943-1Not reported
Ubuntuwgetdeb18.041.19.4-1ubuntu2.2Not reportedUSN-3943-1Not reported
Susewgetrpmlinux enterprise module for basesystem 151.19.5-3.3.1Not reportedSUSE-SU-2019:0093-1Not reported
Opensusewgetrpmleap 15.01.19.5-lp150.2.3.1Not reportedOPENSUSE-SU-2019:0057-1Not reported
Ubuntuwgetdeb18.041.19.4-1ubuntu2.2Not reportedUBUNTU-CVE-2018-20483Not reported

[Debian bug #917375]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [wget]Fixed
    Details (2)

    • 1.21.3-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.20.1-1

      dsa · wget · debian · bookworm; dsa · wget · debian · 12

    • 1.21.3-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.20.1-1

      dsa · wget · debian · bookworm; dsa · wget · debian · 12

[Debian 13 (Trixie)]

  • [wget]Fixed
    Details (2)

    • 1.25.0-2 · amd64 · trixie

      Fixed · Fixed: 1.20.1-1

      dsa · wget · debian · 13

    • 1.25.0-2 · arm64 · trixie

      Fixed · Fixed: 1.20.1-1

      dsa · wget · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]