PT-2025-16930 · Pear · Pear Http Request2

Sad-Spirit · Published 2025-03-14 · Updated 2025-04-17 · CVE-2025-43717

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PEAR HTTP Request2 versions prior to 2.7.0

Description The issue concerns multiple files in the tests directory of PEAR HTTP Request2, specifically tests/ network/getparameters.php and tests/ network/postparameters.php, which reflect any GET or POST parameters. This reflection leads to a cross-site scripting (XSS) issue.

Recommendations For versions prior to 2.7.0, update to version 2.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the tests directory, specifically to the files tests/ network/getparameters.php and tests/ network/postparameters.php, until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

CWE-531

Related Identifiers

BDU:2025-04879

CVE-2025-43717

GHSA-W7GH-F2FM-9Q8R

Affected Products

Pear Http Request2

References · 14

• https://osv.dev/vulnerability/CVE-2025-43717 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w7gh-f2fm-9q8r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43717 · Security Note
• https://bdu.fstec.ru/vul/2025-04879 · Security Note
• https://github.com/pear/HTTP_Request2/blob/b1c61b71128045734d757c4d3d436457ace80ea7/package.xml#L24 · Note
• https://github.com/pear/HTTP_Request2/commit/265e05f9e08a28a38a57219516a8e4e2dfdbb147 · Note
• https://github.com/pear/HTTP_Request2/compare/v2.6.0...v2.7.0 · Note
• https://github.com/pear/HTTP_Request2 · Note
• https://github.com/pear/HTTP_Request2/commit/07925aa77e441dba0ff0fa973a09802729cb838f · Note
• https://github.com/advisories/GHSA-w7gh-f2fm-9q8r · Note
• https://twitter.com/CVEnew/status/1912722251243216962 · Twitter Post
• https://t.me/cvetracker/21835 · Telegram Post
• https://t.me/cvedetector/23212 · Telegram Post
• https://tunnelblick.net/cCVE-2025-43711.html · Note