EXPOSURES › CVE-2020-28949
CVE-2020-28949
HIGH ⌖ ON CISA KEV · EXPLOITEDPEAR Archive_Tar untrusted unserialization allowed remote code execution
PEAR's Archive_Tar component, used in various DIB products, permitted an unserialization attack due to a configuration oversight, leading to remote code execution. This vulnerability was actively exploited in the wild, posing a severe risk to DIB systems.
Shame score — Active exploitation in the wild and known usage in critical infrastructure systems.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.