CVE-2024-38428

Published: Jun 16, 2024Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

Affected (1)

Products: Gnu: Wget

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnu Wget	Up to 1.24.5

Related CWEs

Interpretation Conflict

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

References (6)

https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242ace

Source: cve@mitre.org

Mailing ListPatch

https://lists.gnu.org/archive/html/bug-wget/2024-06/msg00005.html

Source: cve@mitre.org

Mailing ListPatch

https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242ace

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatch

https://lists.debian.org/debian-lts-announce/2025/04/msg00029.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.gnu.org/archive/html/bug-wget/2024-06/msg00005.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatch

https://security.netapp.com/advisory/ntap-20241115-0005/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.