Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2020-7071

FILTER_VALIDATE_URL accepts URLs with invalid userinfo

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
php

Description

In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the URL.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHP Group PHP

  • 7.3.x to < 7.3.26affected
  • 7.4.x to < 7.4.14affected
  • 8.0.X to < 8.0.1affected

References