CVE-2017-5630
HIGH 7.5EPSS 12.5%
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
- CVSS v3.1 NVD
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS v2.0 NVD
- 5.0 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N - EPSS
- 12.51% chance of exploitation in the next 30 days, 96th percentile
- Published
- 2017-02-01
- Updated
- 2024-08-05
ExploitDB entries (1)
Security advisories
- http://pear.php.net/bugs/bug.php?id=21171
- http://www.securityfocus.com/bid/95882
- advisories/GHSA-xxv8-pv43-57x5