CVE-2021-21705: Netapp Clustered Data Ontap

Medium severity, CVSS 5.3. EPSS: 2.1% chance of exploitation in the next 30 days.

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.

Affected products

• Netapp Clustered Data Ontap: affected versions not specified
• Oracle SD-WAN Aware: version 8.2 only
• PHP PHP: from 7.3.0, before 7.3.29 (fixed in 7.3.29); from 7.4.0, before 7.4.21 (fixed in 7.4.21); from 8.0.0, before 8.0.8 (fixed in 8.0.8)

Published 2021-10-04. Last modified 2026-06-17.