5.3

CVE-2024-5458: Filter bypass in filter_var (FILTER_VALIDATE_URL)

Modified
AliasesMGASA-2024-0262SUSE-SU-2024:2027-1SUSE-SU-2024:2038-1
Published 09-06-2024Last modified 03-11-2025

Vulnerability summary

CVE-2024-5458 is a medium (CVSS 5.3) vulnerability in fedoraproject fedora. EPSS estimates a 12.12% chance of exploitation in the next 30 days, higher than 96.1% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
12.12%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 7 · Related 4
DLA-3920-1RHSA-2024:10949RHSA-2024:10950RHSA-2024:10951RHSA-2024:10952RHSA-2025:7315

Timeline

  1. 09-06-2024
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

12.12%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 12.12% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Php Src

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse64 products
  • apache2-mod_php7&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 7.4.33-150400.4.37.1
  • apache2-mod_php7&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 7.4.33-150400.4.37.1
  • apache2-mod_php7&distro=SUSE Linux Enterprise Module for Legacy 15 SP5< 7.4.33-150400.4.37.1
  • apache2-mod_php7&distro=SUSE Linux Enterprise Module for Legacy 15 SP6< 7.4.33-150400.4.37.1
  • apache2-mod_php7&distro=SUSE Linux Enterprise Server 15 SP4-LTSS< 7.4.33-150400.4.37.1
Opensuse19 products
  • apache2-mod_php7&distro=openSUSE Leap 15.5< 7.4.33-150400.4.37.1
  • apache2-mod_php7&distro=openSUSE Leap 15.6< 7.4.33-150400.4.37.1
  • apache2-mod_php8&distro=openSUSE Leap 15.5< 8.0.30-150400.4.43.1
  • php7-embed&distro=openSUSE Leap 15.5< 7.4.33-150400.4.37.1
  • php7-embed&distro=openSUSE Leap 15.6< 7.4.33-150400.4.37.1
Ubuntu6 products
  • php5All versions (No fix recorded)
  • php7.0< 7.0.33-0ubuntu0.16.04.16+esm11
  • php7.2< 7.2.24-0ubuntu0.18.04.17+esm5
  • php7.4< 7.4.3-4ubuntu2.23
  • php8.1< 8.1.2-1ubuntu2.18
Alpine3 products
  • php81< 8.1.29-r0
  • php82< 8.2.20-r0
  • php83< 8.3.8-r0
Chainguard2 products
  • php-8.1< 8.1.29-r0
  • php-8.2< 8.2.20-r0
Debian2 products
  • php7.3< 7.3.31-1~deb10u7
  • php8.2< 8.2.20-1~deb12u1
Wolfi2 products
  • php-8.1< 8.1.29-r0
  • php-8.2< 8.2.20-r0
Fedoraproject1 product
Mageia1 product
  • php< 8.2.21-2.mga9
Php1 product
  • php≥ 7.3.27, ≤ 7.3.33 | ≥ 7.4.15, ≤ 7.4.33 | ≥ 8.0.2, ≤ 8.0.30 | ≥ 8.1.0, < 8.1.29 | ≥ 8.2.0, < 8.2.20 | ≥ 8.3.0, < 8.3.8
Php group1 product
  • php≥ 8.1.*, < 8.1.29 | ≥ 8.2.*, < 8.2.20 | ≥ 8.3.*, < 8.3.8

11 vendors · 102 products

References

27 links
Show all 27 references