CVE-2021-21705 — Improper Input Validation in Group PHP

CWE-20 — Improper Input ValidationCWE-918 — Server-Side Request Forgery10 documents9 sources
Severity
5.3MEDIUMNVD
CNA4.3
EPSS
0.3%
top 47.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
PHP Group PHPPHPOracle Sd-wan Aware
Timeline
PublishedOct 4
Latest updateMay 24

Description

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶NVDphp/php7.3.0 — 7.3.29+2
▶CVEListV5php_group/php7.3.x — 7.3.29+2

Patches

Patch: bugs.php.net ↗Patch: www.oracle.com ↗Patch: bugs.php.net ↗

🔴Vulnerability Details

3
GHSA
GHSA-rxcr-7xjm-f9c9: In PHP versions 7↗2022-05-24
▶
CVEList
Incorrect URL validation in FILTER_VALIDATE_URL↗2021-10-04
▶
OSV
CVE-2021-21705: In PHP versions 7↗2021-10-04
▶

📋Vendor Advisories

6
Oracle
Oracle Oracle Communications Risk Matrix: Management (PHP) — CVE-2021-21705↗2022-01-15
▶
Microsoft
Incorrect URL validation in FILTER_VALIDATE_URL↗2021-10-12
▶
Ubuntu
PHP vulnerabilities↗2021-07-13
▶
Ubuntu
PHP vulnerabilities↗2021-07-07
▶
Red Hat
php: SSRF bypass in FILTER_VALIDATE_URL↗2021-07-01
▶
CVE-2021-21705 — Improper Input Validation in Group PHP | cvebase