CVE-2018-20483 Information disclosure in n/a

What is CVE-2018-20483?

CVE-2018-20483 is a high-severity vulnerability in n/a, published on 26 Dec 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.

Weakness: CWE-200

Which versions are affected by CVE-2018-20483?

It affects 1 product.

Products include Gnu Wget.

How do I fix CVE-2018-20483?

Upgrade to a fixed version.

Is CVE-2018-20483 being exploited?

There is no known exploitation of CVE-2018-20483 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2019-5953 Memory corruption in GNU Wget Critical 9.8
• CVE-2014-4877 Path traversal in n/a Critical 9.3
• CVE-2024-38428 Other in n/a Critical 9.1
• CVE-2026-58469 GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsing High 8.7
• CVE-2016-7098 Race condition in n/a High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2018-20483, CLEANSTART-2026-RQ35898, DEBIAN-CVE-2018-20483, GHSA-mxm6-6r3r-6wj4, MGASA-2019-0015, SUSE-SU-2019:0093-1 and 2 more.