CVE catalog

CVE-2024-10524

wget: CVE-2024-10524

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.07% · Oct 25, 2026

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianwgetsid1.25.0-3fixed
Debianwgetforky1.25.0-3fixed
Debianwgettrixie1.25.0-2fixed
Debianwgetbookworm1.21.3-1+deb12u1vulnerable
Alpinewget3.211.25.0-r0fixed
Alpinewget3.221.25.0-r0fixed
Alpinewget3.231.25.0-r0fixed
Alpinewget3.241.25.0-r0fixed
Ubuntuwgetpro1.20.3-1ubuntu1vulnerable
Ubuntuwgetpro1.20.3-1ubuntu2vulnerable
Ubuntuwgetpro1.20.3-1ubuntu2.1vulnerable
Ubuntuwgetpro1.20.3-1ubuntu2.1+esm2vulnerable
Ubuntuwgetpro1.20.3-1ubuntu2.1+esm3vulnerable
Ubuntuwgetpro1.20.3-1ubuntu2.1+esm4vulnerable
Ubuntuwget22.041.21-1ubuntu3vulnerable
Ubuntuwget22.041.21-1ubuntu4vulnerable
Ubuntuwget22.041.21-1ubuntu5vulnerable
Ubuntuwget22.041.21.2-2ubuntu1vulnerable
Ubuntuwget22.041.21.2-2ubuntu1.1vulnerable
Ubuntuwget22.041.21.2-2ubuntu1.3vulnerable
Ubuntuwget22.041.21.2-2ubuntu1.4vulnerable
Ubuntuwget22.041.21.2-2ubuntu1.5vulnerable
Ubuntuwget24.041.21.3-1ubuntu1vulnerable
Ubuntuwget24.041.21.4-1ubuntu1vulnerable
Ubuntuwget24.041.21.4-1ubuntu2vulnerable
Ubuntuwget24.041.21.4-1ubuntu3vulnerable
Ubuntuwget24.041.21.4-1ubuntu4vulnerable
Ubuntuwget24.041.21.4-1ubuntu4.1vulnerable
Ubuntuwget24.041.21.4-1ubuntu4.3vulnerable
Ubuntuwget24.041.21.4-1ubuntu4.4vulnerable
Ubuntuwget24.041.21.4-1ubuntu4.5vulnerable
Ubuntuwget25.101.24.5-2ubuntu1vulnerable
Ubuntuwget25.101.25.0-2ubuntu1vulnerable
Ubuntuwget25.101.25.0-2ubuntu2vulnerable
Ubuntuwget25.101.25.0-2ubuntu3vulnerable
Susewgetlinux enterprise module for basesystem 15 sp71.24.5-150700.3.3.1fixed
Susewgetlinux micro 6.11.24.5-slfo.1.1_2.1fixed
Susewgetlinux micro 6.01.24.5-2.1fixed
Susewgetlinux enterprise module for basesystem 15 sp61.20.3-150600.19.9.1fixed
Opensusewgetleap 15.61.20.3-150600.19.9.1fixed
Susewgetlinux enterprise server ltss extended security 12 sp51.14-21.25.1fixed
Susewgetlinux enterprise micro 5.51.20.3-150000.3.26.1fixed
Susewgetlinux enterprise module for basesystem 15 sp51.20.3-150000.3.26.1fixed
Opensusewgetleap 15.51.20.3-150000.3.26.1fixed
Opensusewgettumbleweed1.25.0-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianwgetsourcesid1.25.0-1not yet assignedNot reported[1088023]
Debianwgetsourceforky1.25.0-1not yet assignedNot reported[1088023]
Debianwgetsourcetrixie1.25.0-1not yet assignedNot reported[1088023]
Debianwgetsourcebookworm(unfixed)not yet assignedNot reported[1088023]
Alpinewgetapk3.211.25.0-r0Not reportedALPINE-CVE-2024-10524Not reported
Alpinewgetapk3.221.25.0-r0Not reportedALPINE-CVE-2024-10524Not reported
Alpinewgetapk3.231.25.0-r0Not reportedALPINE-CVE-2024-10524Not reported
Alpinewgetapk3.241.25.0-r0Not reportedALPINE-CVE-2024-10524Not reported
Susewgetrpmlinux enterprise module for basesystem 15 sp71.24.5-150700.3.3.1Not reportedSUSE-SU-2026:3148-1Not reported
Susewgetrpmlinux micro 6.11.24.5-slfo.1.1_2.1Not reportedSUSE-SU-2025:20325-1Not reported
Susewgetrpmlinux micro 6.01.24.5-2.1Not reportedSUSE-SU-2025:20097-1Not reported
Susewgetrpmlinux enterprise module for basesystem 15 sp61.20.3-150600.19.9.1Not reportedSUSE-SU-2024:4145-1Not reported
Opensusewgetrpmleap 15.61.20.3-150600.19.9.1Not reportedSUSE-SU-2024:4145-1Not reported
Susewgetrpmlinux enterprise server ltss extended security 12 sp51.14-21.25.1Not reportedSUSE-SU-2025:01921-1Not reported
Susewgetrpmlinux enterprise micro 5.51.20.3-150000.3.26.1Not reportedSUSE-SU-2024:4138-1Not reported
Susewgetrpmlinux enterprise module for basesystem 15 sp51.20.3-150000.3.26.1Not reportedSUSE-SU-2024:4138-1Not reported
Opensusewgetrpmleap 15.51.20.3-150000.3.26.1Not reportedSUSE-SU-2024:4138-1Not reported
Opensusewgetrpmtumbleweed1.25.0-1.1Not reportedOPENSUSE-SU-2024:14492-1Not reported

[Debian bug #1088023]

Notes

[bookworm] wget: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [wget]Affected
    Details (2)

    • 1.21.3-1+deb12u1 · amd64 · bookworm

      Affected

      dsa · wget · debian · bookworm; dsa · wget · debian · 12

    • 1.21.3-1+deb12u1 · arm64 · bookworm

      Affected

      dsa · wget · debian · bookworm; dsa · wget · debian · 12

[openSUSE Tumbleweed]

  • [wget-lang]Unknown

    Source package: [wget]

    Details (1)

    • 1.25.0-7.1 · noarch · tumbleweed

      Unknown · Fixed: 1.25.0-1.1

      Version impact unknown

      dsa · wget · opensuse · tumbleweed

  • [wget]Fixed

    Source package: [wget]

    Details (1)

    • 1.25.0-7.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.25.0-1.1

      dsa · wget · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [wget]Fixed
    Details (2)

    • 1.25.0-2 · amd64 · trixie

      Fixed · Fixed: 1.25.0-1

      dsa · wget · debian · 13

    • 1.25.0-2 · arm64 · trixie

      Fixed · Fixed: 1.25.0-1

      dsa · wget · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]