CVE-2024-5458

CWE-345CWE-20 — Improper Input Validation8 documents8 sources
Severity
5.3MEDIUM
EPSS
3.6%
top 12.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
PHP Group PHPPHP PHPFedoraproject Fedora
Timeline
PublishedJun 9
Latest updateSep 9

Description

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶NVDphp/php8.1.0 — 8.1.29+5
▶CVEListV5php_group/php8.1.* — 8.1.29+2
▶Debianphp7.4< 7.4.33-1+deb11u6
▶Debianphp8.2< 8.2.20-1~deb12u1

Also affects: Fedora 40

🔴Vulnerability Details

2
OSV
CVE-2024-5458: In PHP versions 8↗2024-06-09
▶
CVEList
Filter bypass in filter_var (FILTER_VALIDATE_URL)↗2024-06-09
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation↗2024-04-02
▶

📋Vendor Advisories

4
Ubuntu
PHP vulnerability↗2024-09-09
▶
Microsoft
Filter bypass in filter_var (FILTER_VALIDATE_URL)↗2024-06-11
▶
Debian
CVE-2024-5458: php7.4 - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, du...↗2024
▶
Red Hat
php: Filter bypass in filter_var (FILTER_VALIDATE_URL)↗2022-10-21
▶
CVE-2024-5458 (MEDIUM CVSS 5.3) | In PHP versions 8.1.* before 8.1.29 | cvebase.io