PT-2020-5867 · Php+9 · Php+9
Published
2020-07-06
·
Updated
2025-08-11
·
CVE-2020-7071
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
PHP versions 7.3.x through 7.3.25
PHP versions 7.4.x through 7.4.13
PHP version 8.0.0
Description:
The issue is related to insufficient input validation in PHP's URL validation functions, such as
filter var($url, FILTER VALIDATE URL). This allows an attacker to provide a URL with an invalid password that is accepted as a valid URL. As a result, functions relying on the URL being valid may mis-parse the URL and produce incorrect data as components of the URL.Recommendations:
For PHP versions 7.3.x through 7.3.25, update to version 7.3.26 or later.
For PHP versions 7.4.x through 7.4.13, update to version 7.4.14 or later.
For PHP version 8.0.0, update to a later version that addresses this issue.
As a temporary workaround, consider validating URLs using additional checks to ensure the password is valid before relying on the URL being valid.
Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Php
Red Hat
Rocky Linux
Suse
Ubuntu