Description
In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.
Remediation
References
Related Vulnerabilities
PHP Other Vulnerability (CVE-2015-6834)
Grafana Insufficiently Protected Credentials Vulnerability (CVE-2019-15635)
Jetty Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2021-28163)
WordPress 5.7.x Multiple Vulnerabilities (5.7 - 5.7.4)
TYPO3 Cleartext Storage of Sensitive Information Vulnerability (CVE-2021-21339)