CVE-2007-2519 - CVE House
Back to Database
Status published Medium CVE-2007-2519

Directory traversal vulnerability in the installer in PEAR 1.0 through...

Vulnerability Description

Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the (1) install-as attribute in the file element in package.xml 1.0 or the (2) as attribute in the install element in package.xml 2.0. NOTE: it could be argued that this does not cross privilege boundaries in typical installations, since the code being installed could perform the same actions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-2519

Credits & Attribution

No credits recorded in the NVD database.

References

More from php group

View All →
CVE-2006-7205
The array_fill function in ext/standard/array.c in PHP 4.4.2 and 5.1.2...
Medium 5
CVE-2006-3018
Unspecified vulnerability in the session extension functionality in PHP before...
High 7.5
CVE-2006-3016
Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown...
Critical 9.3

Affected Vendor

Affected Software

pear
Vulnerable Versions:
1.0, 1.0.1, 1.1, 1.2, 1.2.1, 1.2b1, 1.2b2, 1.2b3, 1.2b4, 1.2b5, 1.3, 1.3.1, 1.3.3, 1.3.3.1, 1.3.4, 1.3.5, 1.3.6, 1.3b1, 1.3b2, 1.3b3, 1.3b5, 1.3b6, 1.4.0, 1.4.0a1, 1.4.0a2, 1.4.0a3, 1.4.0a4, 1.4.0a5, 1.4.0a6, 1.4.0a7, 1.4.0a8, 1.4.0a9, 1.4.0a10, 1.4.0a11, 1.4.0a12, 1.4.0b1, 1.4.0b2, 1.4.0rc1, 1.4.0rc2, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.8, 1.4.9, 1.4.10, 1.4.10rc1, 1.4.11, 1.5.0, 1.5.0a1, 1.5.0rc1, 1.5.0rc2, 1.5.0rc3, 1.5.1, 1.5.2, 1.5.3

Timeline

Official Publish: May 22nd, 2007
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.