PHP up to 7.3.28/7.4.20/8.0.7 URL Validation filter_var FILTER_VALIDATE_URL input validation

Summaryinfo

A vulnerability categorized as critical has been discovered in PHP up to 7.3.28/7.4.20/8.0.7. Affected by this vulnerability is the function filter_var of the component URL Validation Handler. The manipulation of the argument FILTER_VALIDATE_URL results in input validation. This vulnerability is cataloged as CVE-2021-21705. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in PHP up to 7.3.28/7.4.20/8.0.7 (Programming Language Software). Affected is the function filter_var of the component URL Validation Handler. The manipulation of the argument FILTER_VALIDATE_URL with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was shared 10/04/2021 as 81122. The advisory is shared for download at bugs.php.net. This vulnerability is traded as CVE-2021-21705 since 01/04/2021. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 7.3.29, 7.4.21 or 8.0.8 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Programming Language Software

Name

• PHP

Version

• 7.3.0
• 7.3.1
• 7.3.2
• 7.3.3
• 7.3.4
• 7.3.5
• 7.3.6
• 7.3.7
• 7.3.8
• 7.3.9
• 7.3.10
• 7.3.11
• 7.3.12
• 7.3.13
• 7.3.14
• 7.3.15
• 7.3.16
• 7.3.17
• 7.3.18
• 7.3.19
• 7.3.20
• 7.3.21
• 7.3.22
• 7.3.23
• 7.3.24
• 7.3.25
• 7.3.26
• 7.3.27
• 7.3.28
• 7.4.0
• 7.4.1
• 7.4.2
• 7.4.3
• 7.4.4
• 7.4.5
• 7.4.6
• 7.4.7
• 7.4.8
• 7.4.9
• 7.4.10
• 7.4.11
• 7.4.12
• 7.4.13
• 7.4.14
• 7.4.15
• 7.4.16
• 7.4.17
• 7.4.18
• 7.4.19
• 7.4.20
• 8.0.0
• 8.0.1
• 8.0.2
• 8.0.3
• 8.0.4
• 8.0.5
• 8.0.6
• 8.0.7

License

• open-source

Website

• Product: https://www.php.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion