5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.006 Low
EPSS
Percentile
77.4%
Severity: Medium
Date : 2021-01-12
CVE-ID : CVE-2020-7071
Package : php
Type : insufficient validation
Remote : No
Link : https://security.archlinux.org/AVG-1415
The package php before version 7.4.14-1 is vulnerable to insufficient
validation.
Upgrade to 7.4.14-1.
The problem has been fixed upstream in version 7.4.14.
None.
A security issue was found in the php_url_parse_ex() function in PHP,
which leads to FILTER_VALIDATE_URL accepting URLs with invalid
userinfo. It is fixed in versions 8.0.1, 7.4.14 and 7.3.26.
A malicious remote user might bypass URL validation.
https://bugs.archlinux.org/task/69242
https://bugs.php.net/bug.php?id=77423
https://git.php.net/?p=php-src.git;a=commitdiff;h=b7f837381ef642d7fb369bfd0069e7525d4c22ea
https://git.php.net/?p=php-src.git;a=commitdiff;h=5346d0ae69f290c7704a39cd10a574a2d661f05a
https://git.php.net/?p=php-src.git;a=commitdiff;h=d4f5aed22193106271510efd643ba8f349b7d85f
https://security.archlinux.org/CVE-2020-7071
bugs.archlinux.org/task/69242
bugs.php.net/bug.php?id=77423
git.php.net/?p=php-src.git;a=commitdiff;h=5346d0ae69f290c7704a39cd10a574a2d661f05a
git.php.net/?p=php-src.git;a=commitdiff;h=b7f837381ef642d7fb369bfd0069e7525d4c22ea
git.php.net/?p=php-src.git;a=commitdiff;h=d4f5aed22193106271510efd643ba8f349b7d85f
security.archlinux.org/AVG-1415
security.archlinux.org/CVE-2020-7071
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.006 Low
EPSS
Percentile
77.4%