CVE-2018-20483

Description

From CVE.org

set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.

Mitigation

wget users should pass credentials using the "--user/password" or the "--user/--ask-password" command line argument to wget or use --no-xattr to turn off saving extended attribute information. In curl downloading extended attributes is disabled by default.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score5.57.8N/A
Attack VectorLocalLocalN/A
Attack ComplexityLowLowN/A
Privileges RequiredNoneLowN/A
User InteractionRequiredNoneN/A
ScopeUnchangedUnchangedN/A
ConfidentialityHighHighN/A
Integrity ImpactNoneHighN/A
Availability ImpactNoneHighN/A

Vector

Red Hat: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

NVD: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Understanding the Weakness (CWE)

CWE-200

Confidentiality

Technical Impact: Read Application Data

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.