CVE-2017-5630: PEAR core file overwrite vulnerability
PEAR core file overwrite vulnerability
Other sources
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5630?
CVE-2017-5630 is considered a medium severity vulnerability due to its potential for file overwriting.
How do I fix CVE-2017-5630?
To fix CVE-2017-5630, ensure you upgrade the PEAR package to a version that includes the validation of file types and filenames.
What kind of attack does CVE-2017-5630 allow?
CVE-2017-5630 allows remote HTTP servers to conduct file overwriting attacks by exploiting improper file validation.
Which version of PEAR is affected by CVE-2017-5630?
CVE-2017-5630 specifically affects PEAR Base System version 1.10.1.
Is CVE-2017-5630 related to any specific file types?
CVE-2017-5630 is particularly noted for its potential to exploit .htaccess file overwrites.