Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

Vulnerability IntelligenceCVE-2024-10524

CVE-2024-10524

MEDIUM6.5

GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs

Published Nov 19, 2024

Modified 1 years ago

Details

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

References

http://www.openwall.com/lists/oss-security/2024/11/18/6

https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778

https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/

https://seclists.org/oss-sec/2024/q4/107

https://security.netapp.com/advisory/ntap-20250321-0007/

https://www.cve.org/CVERecord?id=CVE-2024-10524

CVSS Analysis

CVSS v3.1

6.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

ChangedS:C

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

LowA:L

6.5/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Weakness Type (CWE)

Input Validation

Server-Side Request Forgery (SSRF)

Ecosystems

Timeline

PublishedNov 19, 2024

ModifiedMar 21, 2025

CVE-2024-10524 | Mondoo Vulnerability Intelligence