url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

The version of wget installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-38428 advisory.

  - url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus     there May be insecure behavior in which data that was supposed to be in the userinfo subcomponent is     misinterpreted to be part of the host subcomponent. (CVE-2024-38428)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6852-2 advisory.

    USN-6852-1 fixed a vulnerability in Wget. This update provides the corresponding update for Ubuntu 16.04     LTS and Ubuntu 18.04 LTS.

    Original advisory details:

    It was discovered that Wget incorrectly handled semicolons in the userinfo

    subcomponent of a URI. A remote attacker could possibly trick a user into

    connecting to a different host than expected.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6852-1 advisory.

    It was discovered that Wget incorrectly handled semicolons in the userinfo subcomponent of a URI. A remote     attacker could possibly trick a user into connecting to a different host than expected.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2201-1 advisory.

    - CVE-2024-38428: Fix mishandled semicolons in the userinfo subcomponent of a URI. (bsc#1226419)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2174-1 advisory.

    - CVE-2024-38428: Fix mishandled semicolons in the userinfo subcomponent of a URI. (bsc#1226419)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:2154-1 advisory.

    - CVE-2024-38428: Fix mishandled semicolons in the userinfo subcomponent of a URI. (bsc#1226419)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
201618	CBL Mariner 2.0 Security Update: wget (CVE-2024-38428)	Nessus	MarinerOS Local Security Checks	medium
201110	Ubuntu 16.04 LTS / 18.04 LTS : Wget vulnerability (USN-6852-2)	Nessus	Ubuntu Local Security Checks	medium
201043	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS : Wget vulnerability (USN-6852-1)	Nessus	Ubuntu Local Security Checks	medium
201011	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : wget (SUSE-SU-2024:2201-1)	Nessus	SuSE Local Security Checks	medium
200892	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : wget (SUSE-SU-2024:2174-1)	Nessus	SuSE Local Security Checks	medium
200844	SUSE SLES12 Security Update : wget (SUSE-SU-2024:2154-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-38428

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium