CVE-2024-38428

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-436

Affected software

No affected versions have been published.

Timeline

Published: Jun 16, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-384297.5Matrix Tafnit v8 - CWE-552: Files or Directories Accessible to External Parties CVE-2024-38434.3Insufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a cra CVE-2024-384306.1Matrix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-384317.5Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy CVE-2024-384329.8Matrix Tafnit v8 - CWE-646: Reliance on File Name or Extension of Externally-Supplied File CVE-2024-384336.7Nuvoton - CWE-305: Authentication Bypass by Primary Weakness An attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem tha CVE-2024-384346.5Unitronics Vision PLC – CWE-676: Use of Potentially Dangerous Function may allow security feature bypass CVE-2024-384357.5Unitronics Vision PLC – CWE-703: Improper Check or Handling of Exceptional Conditions may allow denial of service CVE-2024-384366.1Commugen SOX 365 – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-384379.8D-Link - CWE-288:Authentication Bypass Using an Alternate Path or Channel CVE-2024-384389.8D-Link - CWE-294: Authentication Bypass by Capture-replay CVE-2024-384399.8Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in FPLogin