GitHub Advisoryadvisory · Packagist

GHSA-xxv8-pv43-57x5 PEAR core file overwrite vulnerability

HIGH Published 2022-05-13 Modified 2023-07-07 Official page ↗
Aliases
CVE-2017-5630
Ecosystem
Packagist
Packages
pear/pear
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-74
Reviewed
2023-07-07

Affected packages

• Packagist pear/pear: <= 1.10.1 (no fix yet)

Description

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.

Related

Alias · CVE (1)

  • CVE-2017-5630 PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References