CVE-2025-43717: XSS
Published Apr 17, 2025
·Updated
In PEAR HTTPRequest2 before 2.7.0, multiple files in the tests directory, notably tests/network/getparameters.php and tests/network/postparameters.php, reflect any GET or POST parameters, leading to XSS.
Affected Software
2 affected componentsFixes available
PEAR HTTP_Request2<2.7.0
composer/pear/http_request2<2.7.0
2.7.0
Event History
Apr 17, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 AM
DescriptionSeverityWeakness
Advisory Published
via GitHub·03:30 AM
Jun 14, 57318
Event
via FIRST·11:59 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-43717?
CVE-2025-43717 has a high severity due to its potential to facilitate cross-site scripting (XSS) attacks.
2
How do I fix CVE-2025-43717?
To fix CVE-2025-43717, upgrade to PEAR HTTP_Request2 version 2.7.0 or later.
3
What are the affected versions for CVE-2025-43717?
CVE-2025-43717 affects PEAR HTTP_Request2 versions prior to 2.7.0.
4
What type of vulnerability is CVE-2025-43717?
CVE-2025-43717 is classified as a cross-site scripting (XSS) vulnerability.
5
Where can CVE-2025-43717 be exploited?
CVE-2025-43717 can be exploited in applications that use the affected test files to handle GET or POST parameters.