CVE-2017-5630

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows…

published February 1, 2017

CVSS
—
EPSS
13%
Percentile
96.2
In the wild
Unconfirmed
What it is

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.12513 · 96.2th percentile
Published
2017-02-01T23:00Z
EPSS history
Timeline
  • 01 FEB 23:00Z
    PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows…
    cvelistv5