CVE-2010-2252: gnu wget Improper Input Validation
Vulnerability summary
CVE-2010-2252 is a medium (CVSS 6.8) Improper Input Validation vulnerability in gnu wget. EPSS estimates a 4.21% chance of exploitation in the next 30 days, higher than 90.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 06-07-2010PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
4.21%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.21% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat2 products
- wget< 0:1.12-1.11.el6_5
- wget-debuginfo< 0:1.12-1.11.el6_5
Debian1 product
- wget< 1.12-2.1 | < 1.11.4-2+lenny2
Gnu1 product
- wget≤ 1.12 | 1.5.3 | 1.6 | 1.7 | 1.7.1 | 1.8 | 1.8.1 | 1.8.2 | 1.9 | 1.9.1 | 1.10 | 1.10.1 | 1.10.2 | 1.11 | 1.11.1 | 1.11.2 | 1.11.3 | 1.11.4
3 vendors · 4 products
References
26 linksShow all 26 references
- bugzilla.redhat.com/show_bug.cgi?id=591580X Refsource CONFIRM
