CVE-2020-7071

FILTER_VALIDATE_URL accepts URLs with invalid userinfo

In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the URL.

We have discovered 385,065 live websites that are affected by CVE-2020-7071.

Run a Free Instant Scan



Affected Software

Product  PHP
Category Programming Languages
Vulnerable Domains385,065 live websites (4.97% of PHP install base)
Vulnerable Versions
  • from 7.3 through 7.3.26
  • from 7.4 through 7.4.14
  • from 8 through 8.0.1
Vulnerable Versions Count41 versions ( 8.20% of all versions)


Common Weakness Enumeration

CWE-20 Improper Input Validation



Details

  • Published - Feb 15, 2021
  • Updated - Sep 16, 2024

Credits

  • Reported by jifan dot jf at alibaba-inc dot com

Website Distribution by Country

Number of websites using CVE-2020-7071
United States151,936 websites


France139,019 websites
Russia8,665 websites
Germany7,945 websites
Canada7,208 websites
China6,367 websites
Poland6,117 websites
Japan5,782 websites
Italy4,994 websites
Spain4,958 websites

Website Distribution by TLD

Number of websites using CVE-2020-7071
.com201,661 websites
.fr58,026 websites
.org21,771 websites
.net11,689 websites
.ru7,201 websites
.be6,953 websites
.pl5,899 websites
.it5,163 websites
.de4,796 websites
.ca4,605 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2020-7071

Top websites that are affected by CVE-2020-7071. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*****.pl Poland*,***
******.com France*,***
**********.com France*,***
*********.ua Ukraine*,***
******.com France*,***
*********.com United States*,***
**********.com Sweden**,***
*********.be France**,***
**************.com United States**,***
***********************.com United States**,***
See full domain list

FAQ

CVE-2020-7071 is Improper Input Validation in PHP
A total of 385,065 websites have been identified as vulnerable to CVE-2020-7071, based on global website indexing conducted by WebTechSurvey.
The PHP is affected by the CVE-2020-7071 vulnerability.
PHP versions up to 8.0.1 are vulnerable to CVE-2020-7071.
CVE-2020-7071 is resolved in version 8.0.1 of PHP.