← Back

CVE-2024-5458

nvd nist
Published: Jun 9, 2024Modified: Jun 17, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.

Affected (7)

Products: Php: Php · Fedoraproject: Fedora
Php
1 product
Php
Fedoraproject
1 product
Fedora
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Php
Php
From 7.3.27 to 7.3.33
Php
From 7.4.15 to 7.4.33
Php
From 8.0.2 to 8.0.30
Php
From 8.1.0 to 8.1.29
Php
From 8.2.0 to 8.2.20
Php
From 8.3.0 to 8.3.8
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Fedora
Version 40

Related CWEs

CWE-345
Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (13)

Source: security@php.net
Mailing ListThird Party Advisory
Source: security@php.net
ExploitVendor Advisory
Source: security@php.net
Source: security@php.net
Third Party Advisory
Source: security@php.net
Source: security@php.net
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.