{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/cloudlinux7els/vex/2024/cve-2024-10524-els_os-cloudlinux7els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-19T09:03:26Z",
      "generator": {
        "date": "2026-10-19T09:03:26Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2024-10524-ELS_OS-CLOUDLINUX7ELS",
      "initial_release_date": "2024-11-19T15:15:00Z",
      "revision_history": [
        {
          "date": "2024-11-19T15:15:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-18T19:04:05Z",
          "number": "2",
          "summary": "Official Publication"
        },
        {
          "date": "2026-10-19T09:03:26Z",
          "number": "3",
          "summary": "Update document"
        }
      ],
      "status": "final",
      "version": "3"
    },
    "title": "Security update on CVE-2024-10524"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CloudLinux 7",
                "product": {
                  "name": "CloudLinux 7",
                  "product_id": "CloudLinux-7",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:cloudlinux:cloudlinux:7:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "CloudLinux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "wget-0:1.14-18el7_6.1.x86_64",
                "product": {
                  "name": "wget-0:1.14-18el7_6.1.x86_64",
                  "product_id": "wget-0:1.14-18el7_6.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/wget@1.14-18el7_6.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wget-0:1.14-18.el7_6.1.x86_64",
                "product": {
                  "name": "wget-0:1.14-18.el7_6.1.x86_64",
                  "product_id": "wget-0:1.14-18.el7_6.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/wget@1.14-18.el7_6.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Cloud Linux Software, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "wget-0:1.14-18el7_6.1.tuxcare.els1.x86_64",
                "product": {
                  "name": "wget-0:1.14-18el7_6.1.tuxcare.els1.x86_64",
                  "product_id": "wget-0:1.14-18el7_6.1.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/wget@1.14-18el7_6.1.tuxcare.els1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wget-0:1.14-18.el7_6.1.tuxcare.els2.x86_64",
                "product": {
                  "name": "wget-0:1.14-18.el7_6.1.tuxcare.els2.x86_64",
                  "product_id": "wget-0:1.14-18.el7_6.1.tuxcare.els2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/wget@1.14-18.el7_6.1.tuxcare.els2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.14-18el7_6.1.tuxcare.els1.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:wget-0:1.14-18el7_6.1.tuxcare.els1.x86_64"
        },
        "product_reference": "wget-0:1.14-18el7_6.1.tuxcare.els1.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.14-18.el7_6.1.tuxcare.els2.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:wget-0:1.14-18.el7_6.1.tuxcare.els2.x86_64"
        },
        "product_reference": "wget-0:1.14-18.el7_6.1.tuxcare.els2.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.14-18el7_6.1.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:wget-0:1.14-18el7_6.1.x86_64"
        },
        "product_reference": "wget-0:1.14-18el7_6.1.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.14-18.el7_6.1.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:wget-0:1.14-18.el7_6.1.x86_64"
        },
        "product_reference": "wget-0:1.14-18.el7_6.1.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-10524",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "notes": [
        {
          "category": "description",
          "text": "Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "CloudLinux-7:wget-0:1.14-18.el7_6.1.tuxcare.els2.x86_64",
          "CloudLinux-7:wget-0:1.14-18.el7_6.1.x86_64",
          "CloudLinux-7:wget-0:1.14-18el7_6.1.tuxcare.els1.x86_64",
          "CloudLinux-7:wget-0:1.14-18el7_6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2024-10524"
        },
        {
          "category": "external",
          "summary": "https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778",
          "url": "https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778"
        },
        {
          "category": "external",
          "summary": "https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/",
          "url": "https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/"
        },
        {
          "category": "external",
          "summary": "https://seclists.org/oss-sec/2024/q4/107",
          "url": "https://seclists.org/oss-sec/2024/q4/107"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2024/11/18/6",
          "url": "http://www.openwall.com/lists/oss-security/2024/11/18/6"
        },
        {
          "category": "external",
          "summary": "https://security.netapp.com/advisory/ntap-20250321-0007/",
          "url": "https://security.netapp.com/advisory/ntap-20250321-0007/"
        }
      ],
      "release_date": "2024-11-19T15:15:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-10-19T08:52:50.687503Z",
          "details": "This issue only triggers when an application calls Wget using the deprecated “shorthand” URL form and embeds attacker-controlled credentials in that URL; Wget’s normal use with fully qualified URLs or without credential embedding is not affected. Even then, the outcome is limited to SSRF/host-misdirection with low confidentiality, integrity, and availability impact, and it does not provide code execution or privilege escalation. Since Wget 1.25.0 removes the vulnerable shorthand parsing and avoiding shorthand URLs fully sidesteps the issue, this CVE can be safely deprioritized for centrally managed server/VM deployments.",
          "product_ids": [
            "CloudLinux-7:wget-0:1.14-18.el7_6.1.tuxcare.els2.x86_64",
            "CloudLinux-7:wget-0:1.14-18.el7_6.1.x86_64",
            "CloudLinux-7:wget-0:1.14-18el7_6.1.tuxcare.els1.x86_64",
            "CloudLinux-7:wget-0:1.14-18el7_6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CloudLinux-7:wget-0:1.14-18.el7_6.1.tuxcare.els2.x86_64",
            "CloudLinux-7:wget-0:1.14-18.el7_6.1.x86_64",
            "CloudLinux-7:wget-0:1.14-18el7_6.1.tuxcare.els1.x86_64",
            "CloudLinux-7:wget-0:1.14-18el7_6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}