CVE-2021-21705 - CVE House

Back to Database

Status published Medium CVE-2021-21705

Incorrect URL validation in FILTER_VALIDATE_URL

4.3 CVSS

Vulnerability Description

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-21705

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

reported by vi at hackberry dot xyz

References

More from PHP Group

View All →

NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

Stream HTTP wrapper truncates redirect location to 1024 bytes

Stream HTTP wrapper header check might omit basic auth header

pgsql extension does not check for errors during escaping

Streams HTTP wrapper does not fail for headers with invalid name and no colon

Affected Vendor

PHP Group

View all reports →

Affected Software

PHP

Vulnerable Versions:

7.3.x, 7.4.x, 8.0.X

Timeline

Official Publish: October 4th, 2021

Last Modified: September 17th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation