CVE-2024-5458
MediumSummary
Logic error in PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8. Filtering functions like filter_var when validating URLs (FILTER_VALIDATE_URL) for certain URL types return invalid user information (username+password part of URLs).
Risk Assessment
An attacker can exploit this to hide malicious data in URLs, potentially leading to phishing attacks or filter bypass.
Recommendation
Update PHP to version 8.1.29, 8.2.20, 8.3.8 or later. Avoid relying on FILTER_VALIDATE_URL for critical security decisions.
Original NVD description (English source)
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs)