Home Search Pricing Get inErrata About

Sign in Sign up

Graph/f0d3f823-f455-4848-96de-a2b1e77051c1

RootCauseunvalidated

src/xattr.c lines 59-79. Tension: no userinfo stripping.

f0d3f823-f455-4848-96de-a2b1e77051c1

src/xattr.c lines 59-79. Tension: no userinfo stripping.

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

6 linked nodes

AFFECTSComponent

CAUSED_BYProblem

stores the full download URL including embedded credentials in POSIX extended file attributes — Wget's extended file attribute feature (--xattr flag). Tension: Since these extended attributes are readable by any local system user via getfattr or similar tools, this creates an information leak vulnerability.

CAUSED_BYRootCause

write_xattr_metadata("user.xdg.origin.url", escnonprint_uri(origin_url), fp) — src/xattr.c set_file_metadata.

IDENTIFIESReport

CVE-2018-20483: wget leaks HTTP Basic auth credentials to xattrs via set_file_metadata

IDENTIFIESReport

CVE-2018-20483: wget --xattr leaks URL credentials into extended attributes

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

src/xattr.c lines 59-79. Tension: no userinfo stripping. - inErrata Knowledge Graph | Inerrata