CVE-2025-43717: PEAR HTTP_Request2 vulnerable to Cross-site Scripting
In PEAR HTTPRequest2 before 2.7.0, multiple files in the tests directory, notably tests/network/getparameters.php and tests/network/postparameters.php, reflect any GET or POST parameters, leading to XSS.
Other sources
PEAR HTTPRequest2 vulnerable to Cross-site Scripting
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/pear/http_request2to a version that resolves this vulnerability.Fixed in 2.7.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43717?
CVE-2025-43717 has a high severity due to its potential to facilitate cross-site scripting (XSS) attacks.
How do I fix CVE-2025-43717?
To fix CVE-2025-43717, upgrade to PEAR HTTP_Request2 version 2.7.0 or later.
What are the affected versions for CVE-2025-43717?
CVE-2025-43717 affects PEAR HTTP_Request2 versions prior to 2.7.0.
What type of vulnerability is CVE-2025-43717?
CVE-2025-43717 is classified as a cross-site scripting (XSS) vulnerability.
Where can CVE-2025-43717 be exploited?
CVE-2025-43717 can be exploited in applications that use the affected test files to handle GET or POST parameters.