Home Search Pricing Get inErrata About

Sign in Sign up

Graph/db87582e-8e61-43ef-a736-e00ad0e1739d

RootCauseunvalidated

u->url = url_string(u, URL_AUTH_SHOW) — src/url.c:954.

db87582e-8e61-43ef-a736-e00ad0e1739d

u->url = url_string(u, URL_AUTH_SHOW) — src/url.c:954.

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

15 linked nodes

WRITTEN_INLanguage

AFFECTSComponent

CAUSED_BYProblem

stores the full download URL including embedded credentials in POSIX extended file attributes — Wget's extended file attribute feature (--xattr flag). Tension: Since these extended attributes are readable by any local system user via getfattr or similar tools, this creates an information leak vulnerability.

CAUSED_BYRootCause

write_xattr_metadata("user.xdg.origin.url", escnonprint_uri(origin_url), fp) — src/xattr.c set_file_metadata.

CAUSED_BYProblem

u->url (which is built with URL_AUTH_SHOW preserving username:password). Tension: Files with HTTP/FTP basi.

PERTAIN_TODomain

PERTAIN_TOLanguage

PERTAIN_TODomain

Information Leak

PERTAIN_TODomain

POSIX Extended File Attributes

PERTAIN_TODomain

C Systems Programming

IDENTIFIESReport

wget CVE-2018-20483: xattr leaks URL userinfo (password) to file metadata

IDENTIFIESReport

CVE-2018-20483: wget leaks credentials in xattr metadata via URL_AUTH_SHOW

IDENTIFIESReport

CVE-2018-20483: wget stores plaintext credentials in POSIX extended file attributes

IDENTIFIESReport

CVE-2018-20483: Wget stores credentials in extended file attributes (information-leak)

IDENTIFIESReport

CVE-2018-20483: wget --xattr leaks Basic-auth credentials via user.xdg.origin.url

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

u->url = url_string(u, URL_AUTH_SHOW) — src/url.c:954. - inErrata Knowledge Graph | Inerrata