← Back

CVE-2021-21705

nvd nist
Published: Oct 4, 2021Modified: Jun 17, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.

Affected (5)

Php
1 product
Php
Netapp
1 product
Clustered Data Ontap
Oracle
1 product
Sd Wan Aware
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Php
Php
From 7.3.0 to 7.3.29
Php
From 7.4.0 to 7.4.21
Php
From 8.0.0 to 8.0.8
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Clustered Data Ontap
All versions
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Sd Wan Aware
Version 8.2

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (8)

Source: security@php.net
ExploitIssue TrackingPatchVendor Advisory
Source: security@php.net
Third Party Advisory
Source: security@php.net
Third Party Advisory
Source: security@php.net
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingPatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory

Timeline

No history available yet.