NetSight
IP …
medium5.3

CVE-2020-7071

In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accep…

Impact

In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the URL.

Affected products

VendorProductAffected versions
PhpPhp
from 7.3.0 before 7.3.26
from 7.4.0 before 7.4.14
from 8.0.0 before 8.0.1
DebianDebian Linux
Versions 9.0, 10.0
NetappClustered Data Ontap
All versions

Weakness classification

CWE-20

References