CVE-2024-5458

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published: Jun 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-54594.3The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check CVE-2024-54608.1A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Brocade Fabric OS versions before CVE-2024-54618.0Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC5022) embedded switch blade, makes intern CVE-2024-54627.5If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passwords, then the SNMP privsecret / authsec CVE-2024-54636.5A vulnerability regarding buffer copy without checking the size of input ('Classic Buffer Overflow') has been found in the login component. CVE-2024-54643.3Vulnerability of insufficient permission verification in the NearLink module Impact: Successful exploitation of this vulnerability may affec CVE-2024-54655.5Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-546586.5The issue was addressed with improved memory handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS CVE-2024-54668.8Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote co CVE-2024-546608.7A JNDI injection issue was discovered in Cloudera JDBC Connector for Hive before 2.6.26 and JDBC Connector for Impala before 2.6.35. Attacke CVE-2024-546619.8readline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file.CVE-2024-546629.1Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod.