CVE-2017-5630: High severity PHP pear vulnerability
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5630?
CVE-2017-5630 is considered a medium severity vulnerability due to its potential for file overwriting.
How do I fix CVE-2017-5630?
To fix CVE-2017-5630, ensure you upgrade the PEAR package to a version that includes the validation of file types and filenames.
What kind of attack does CVE-2017-5630 allow?
CVE-2017-5630 allows remote HTTP servers to conduct file overwriting attacks by exploiting improper file validation.
Which version of PEAR is affected by CVE-2017-5630?
CVE-2017-5630 specifically affects PEAR Base System version 1.10.1.
Is CVE-2017-5630 related to any specific file types?
CVE-2017-5630 is particularly noted for its potential to exploit .htaccess file overwrites.