{"id":"GHSA-xxv8-pv43-57x5","aliases":["CVE-2017-5630"],"title":"PEAR core file overwrite vulnerability","description":"PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.","severity":"high","score":7.5,"published":"2022-05-13T01:28:45.000Z","modified":"2023-11-08T03:59:22.059Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"pear/pear","ranges":[{"events":[{"introduced":"0"},{"last_affected":"1.10.1"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2017-5630","https://github.com/pear/pear-core","https://vimeo.com/201341280","https://web.archive.org/web/20210123222048/https://www.securityfocus.com/bid/95882","https://www.exploit-db.com/exploits/41185","http://hyp3rlinx.altervista.org/advisories/PEAR-ARBITRARY-FILE-DOWNLOAD.txt","http://pear.php.net/bugs/bug.php?id=21171"],"sources":[{"name":"OSV","id":"GHSA-xxv8-pv43-57x5","modified":"2023-11-08T03:59:22.059808Z","url":"https://osv.dev/vulnerability/GHSA-xxv8-pv43-57x5"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5}]}