CVE-2021-31879CWE-601

CVE-2021-31879

Medium · published April 29, 2021

CVSS v3.1
6.1
EPSS
1%
Percentile
65.5
In the wild
Unconfirmed
What it is

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01104 · 65.5th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2021-04-29T09:15Z
Affected products (6)
ProductVersionsFixed in
gnu/wget≤ 1.21.1—
broadcom/brocade_fabric_operating_system_firmwareall versions—
netapp/cloud_backupall versions—
netapp/ontap_select_deploy_administration_utilityall versions—
netapp/a250_firmwareall versions—
netapp/500f_firmwareall versions—
References (4)
https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html · [email protected]https://security.netapp.com/advisory/ntap-20210618-0002/ · [email protected]https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20210618-0002/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 29 APR 03:03Z
    GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007
    cvelistv5