CVE-2021-21705

Name

CVE-2021-21705

Description

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.

NVD Severity

medium

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

Type	URI
CONFIRM	https://bugs.php.net/bug.php?id=81122
Third Party Advisory	https://security.netapp.com/advisory/ntap-20211029-0006/
Patch	https://www.oracle.com/security-alerts/cpujan2022.html

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:php:php::::::::`	php	>= 7.3.0	< 7.3.29
`cpe:2.3:a:php:php::::::::`	php	>= 7.4.0	< 7.4.21
`cpe:2.3:a:php:php::::::::`	php	>= 8.0.0	< 8.0.8

References

Match rules

Vulnerable and fixed packages