CVE Catalog
CVE-2024-38428
MediumSummary
Vulnerability in GNU Wget up to version 1.24.5. The url.c function mishandles semicolons in the userinfo component of a URI, potentially leading to misinterpretation of data as part of the host.
Risk Assessment
An attacker can exploit this to redirect Wget requests to malicious servers or bypass URL-based security controls.
Recommendation
Update Wget to version 1.24.5 or later. Avoid using semicolons in URL credentials.
Original NVD description (English source)
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.