CVE-2020-7071: FILTER_VALIDATE_URL accepts URLs with invalid userinfo
Published Jan 4, 2021
·Updated
FILTERVALIDATEURL accepts URLs with invalid userinfo
Other sources
In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filtervar($url, FILTERVALIDATEURL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the URL.
Affected Software
10 affected componentsFixes available
debian/php7.3
7.3.31-1~deb10u17.3.31-1~deb10u5
debian/php7.4
7.4.33-1+deb11u4
PHP PHP<8.0.1
8.0.1
PHP PHP>=7.3.0<7.3.26
PHP PHP>=7.4.0<7.4.14
PHP PHP>=8.0.0<8.0.1
Debian Debian Linux=9.0
Debian Debian Linux=10.0
NetApp Clustered Data ONTAP
Microsoft cbl2 php 7.4.14-3
Remediation
Patch Available
Event History
Jan 7, 2021
CVE Published
via PHP·12:00 AM
Feb 15, 2021
CVE Published
via MITRE·04:10 AM
Data Sourced
via MITRE·04:10 AM
DescriptionSeverityWeakness
Oct 1, 2025
Data Sourced
via Microsoft·11:11 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·11:11 PM
Affected Software
Updated
via Microsoft·11:11 PM
DescriptionSeverity
Frequently Asked Questions
1
What is the vulnerability ID of this bug?
The vulnerability ID of this bug is CVE-2020-7071.
2
What is the title of this bug?
The title of this bug is 'Fixed bug (FILTER_VALIDATE_URL accepts URLs with invalid userinfo).'
3
What is the description of this bug?
The description of this bug is 'Fixed bug (FILTER_VALIDATE_URL accepts URLs with invalid userinfo).'
4
What software is affected by this bug?
PHP PHP version up to 7.3.26 is affected by this bug.
5
How can I fix this bug?
You can fix this bug by updating PHP to version 7.3.26 or higher.