CVE-2024-5458

Filter bypass in filter_var (FILTER_VALIDATE_URL)

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.

We have discovered 415,221 live websites that are affected by CVE-2024-5458.

Test my site



Affected Software

Product  PHP
Category Programming Languages
Vulnerable Domains415,221 live websites (4.76% of PHP install base)
Vulnerable Versions
  • from 8.1 before 8.1.29
  • from 8.2 before 8.2.20
  • from 8.3 before 8.3.8
Vulnerable Versions Count57 versions ( 10.42% of all versions)



Details

  • Published - Jun 9, 2024
  • Updated - Mar 14, 2025

Credits

  • c01l (reporter)

CVE-2024-5458 usage by Country

United States99,898 websites


France77,653 websites
Cyprus64,986 websites
Germany43,029 websites
Netherlands27,398 websites
Russia14,184 websites
Iran8,643 websites
Brazil7,553 websites
Australia6,975 websites
GB4,847 websites

CVE-2024-5458 usage by TLD

.com162,408 websites
.fr30,300 websites
.nl25,434 websites
.org16,783 websites
.com.br14,631 websites
.ru14,569 websites
.net11,163 websites
.de7,121 websites
.be6,887 websites
.cn6,844 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-5458

Top websites that are affected by CVE-2024-5458. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
********.com United States***
******.com United States*,***
*****.cz Czech Republic*,***
********.********.it Italy*,***
***.com United States*,***
*******.com Germany*,***
****.com China*,***
*********.com United States*,***
*****.com United States*,***
**********.edu United States*,***
See full domain list

FAQ

A total of 415,221 websites have been identified as vulnerable to CVE-2024-5458, discovered through global website indexing conducted by WebTechSurvey.
PHP is susceptible to CVE-2024-5458 vulnerability.
PHP versions before 8.3.8 are vulnerable to CVE-2024-5458.
Version 8.3.8 of PHP addresses the CVE-2024-5458 security vulnerability.