CVE-2018-20483

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2018-12-26T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-11-06T00:08:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "GLSA-201903-08", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201903-08"}, {"name": "106358", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/106358"}, {"tags": ["x_refsource_MISC"], "url": "https://twitter.com/marcan42/status/1077676739877232640"}, {"tags": ["x_refsource_MISC"], "url": "http://git.savannah.gnu.org/cgit/wget.git/tree/NEWS"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://security.netapp.com/advisory/ntap-20190321-0002/"}, {"name": "USN-3943-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/3943-1/"}, {"name": "RHSA-2019:3701", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:3701"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-20483", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "GLSA-201903-08", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201903-08"}, {"name": "106358", "refsource": "BID", "url": "http://www.securityfocus.com/bid/106358"}, {"name": "https://twitter.com/marcan42/status/1077676739877232640", "refsource": "MISC", "url": "https://twitter.com/marcan42/status/1077676739877232640"}, {"name": "http://git.savannah.gnu.org/cgit/wget.git/tree/NEWS", "refsource": "MISC", "url": "http://git.savannah.gnu.org/cgit/wget.git/tree/NEWS"}, {"name": "https://security.netapp.com/advisory/ntap-20190321-0002/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20190321-0002/"}, {"name": "USN-3943-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/3943-1/"}, {"name": "RHSA-2019:3701", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:3701"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T12:05:16.988Z"}, "title": "CVE Program Container", "references": [{"name": "GLSA-201903-08", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201903-08"}, {"name": "106358", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/106358"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://twitter.com/marcan42/status/1077676739877232640"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://git.savannah.gnu.org/cgit/wget.git/tree/NEWS"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://security.netapp.com/advisory/ntap-20190321-0002/"}, {"name": "USN-3943-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/3943-1/"}, {"name": "RHSA-2019:3701", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:3701"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-20483", "datePublished": "2018-12-26T18:00:00.000Z", "dateReserved": "2018-12-26T00:00:00.000Z", "dateUpdated": "2024-08-05T12:05:16.988Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:*", "matchCriteriaId": "84434C8C-F6C0-4FBC-B469-9E45D98FFE75", "versionEndExcluding": "1.20.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl."}, {"lang": "es", "value": "set_file_metadata en xattr.c en GNU Wget, en versiones anteriores a la 1.20.1, almacena la URL de origen de un archivo en el atributo de metadatos user.xdg.origin.url de los atributos extendidos del archivo descargado. Esto permite que usuarios locales obtengan informaci\u00f3n sensible (como credenciales contenidas en la URL) al leer este atributo, tal y como queda demostrado con getfattr. Esto tambi\u00e9n aplica a la informaci\u00f3n de Referer en el atributo de metadatos user.xdg.referrer.url. Seg\u00fan la entrada del 22/07/2016 en el ChangeLog de Wget, user.xdg.origin.url estaba parcialmente basado en el comportamiento de fwrite_xattr en tool_xattr.c en curl."}], "id": "CVE-2018-20483", "lastModified": "2026-06-17T01:52:56.673", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-12-26T18:29:00.480", "references": [{"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "http://git.savannah.gnu.org/cgit/wget.git/tree/NEWS"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/106358"}, {"source": "cve@mitre.org", "url": "https://access.redhat.com/errata/RHSA-2019:3701"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/201903-08"}, {"source": "cve@mitre.org", "url": "https://security.netapp.com/advisory/ntap-20190321-0002/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://twitter.com/marcan42/status/1077676739877232640"}, {"source": "cve@mitre.org", "url": "https://usn.ubuntu.com/3943-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "http://git.savannah.gnu.org/cgit/wget.git/tree/NEWS"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/106358"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2019:3701"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/201903-08"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20190321-0002/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://twitter.com/marcan42/status/1077676739877232640"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://usn.ubuntu.com/3943-1/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2019:3701", "cpe": "cpe:/o:redhat:enterprise_linux:8", "impact": "low", "package": "curl-0:7.61.1-11.el8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2019-11-05T00:00:00Z"}], "bugzilla": {"description": "wget: Information exposure in set_file_metadata function in xattr.c", "id": "1662705", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1662705"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-200", "details": ["set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl."], "mitigation": {"lang": "en:us", "value": "wget users should pass credentials using the \"--user/password\" or the \"--user/--ask-password\" command line argument to wget or use --no-xattr to turn off saving extended attribute information. In curl downloading extended attributes is disabled by default."}, "name": "CVE-2018-20483", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "impact": "low", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "wget", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "impact": "low", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "wget", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Will not fix", "impact": "low", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "wget", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "wget", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2018-12-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2018-20483\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-20483\nhttp://git.savannah.gnu.org/cgit/wget.git/tree/NEWS"], "threat_severity": "Moderate"}

{}