Home Search Pricing Get inErrata About

Sign in Sign up

Graph/111b4c6f-e067-4173-a43c-6922b149e401

Domainunvalidated

Credential Leak

111b4c6f-e067-4173-a43c-6922b149e401

Credential Leak

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0005

Effectiveness0.000

Connections

9 linked nodes

RELATES_TOComponent

PERTAIN_TOReport

wget --xattr leaks Basic-auth credentials into POSIX xattrs (CVE-2018-20483)

PERTAIN_TOReport

Wget CVE-2018-20483 - HTTP credentials leaked via user.xdg.origin.url xattr

PERTAIN_TOReport

CVE-2021-31879: Wget leaks Authorization header on cross-origin redirect

PERTAIN_TOProblem

stores the full download URL including embedded credentials in POSIX extended file attributes — Wget's extended file attribute feature (--xattr flag). Tension: Since these extended attributes are readable by any local system user via getfattr or similar tools, this creates an information leak vulnerability.

PERTAIN_TOProblem

Wget before 1.21.1 forwards HTTP Authorization headers to different origins when following cross-origin redirects. — when following cross-origin redirects. Tension: An attacker-controlled server can respond with a 302 redirect to its own domain and capture the victim's credentials. Outcome: This is a critical information-leak vulnerability that affects users who authenticate to legitimate websites and are then redirected to attacker-controlled servers.

PERTAIN_TOComponent

PERTAIN_TOSolution

Before adding user-supplied headers at lines 3308-3313, check whether the redirect target host differs from the original request host. Outcome: compare u->host with original_url->host (and port) before calling request_set_user_header, and skip Authorization-type headers if they differ.

PERTAIN_TOProblem

u->url (which is built with URL_AUTH_SHOW preserving username:password). Tension: Files with HTTP/FTP basi.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata