Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

The version of wget installed on the remote host is prior to 1.25.0. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-316-01 advisory.

    New wget packages are available for Slackware 15.0 and -current to fix a security issue.

Tenable has extracted the preceding description block directly from the wget security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

CVE-2024-10524

medium

Tenable Plugins

critical