CVE-2021-21705

MEDIUM

PHP 7.3.0-7.3.28 - Improper Input Validation in filter_var URL Validation

Title source: llm
STIX 2.1

Description

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.

References (4)

Core 4
Core References
Exploit, Issue Tracking, Patch, Vendor Advisory x_refsource_misc
https://bugs.php.net/bug.php?id=81122
Patch, Vendor Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujan2022.html
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20211029-0006/
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202209-20

Scores

CVSS v3 4.3
EPSS 0.0029
EPSS Percentile 52.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Details

CWE
CWE-20
Status published
Products (3)
netapp/clustered_data_ontap
oracle/sd-wan_aware 8.2
php/php 7.3.0 - 7.3.29
Published Oct 04, 2021
Tracked Since Feb 18, 2026