Cyber Resilience

CVE-2025-43717

Published
17 April 2025
Modified
17 June 2026
CVSS Score v3.1 5.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
EPSS Score 0.0032 24th percentile
Risk Priority 42 floored blend · peak EPSS

Summary

CVE-2025-43717 is a medium-severity Inclusion of Sensitive Information in Test Code (CWE-531) vulnerability. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

In PEAR HTTP_Request2 before 2.7.0, multiple files in the tests directory, notably tests/_network/getparameters.php and tests/_network/postparameters.php, reflect any GET or POST parameters, leading to XSS.

CWE(s)
CWE-531

Related Threats

MITRE ATT&CK Enterprise Techniques

T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-42213Shared CWE-531

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation activities can include static analysis or code review that discovers hard-coded credentials or secrets inside test modules.

SA-15 Development Process, Standards, and Tools partial match

Requiring a documented development process and tools can enforce coding standards and review steps that prevent sensitive information from being left in test code.

SA-3 System Development Life Cycle partial match

Incorporating security into the SDLC can include standards that prohibit embedding sensitive data inside test code or applications.

SA-8 Security and Privacy Engineering Principles partial match

Security engineering principles applied during development can require separation of test data from production secrets and removal of sensitive literals from test artifacts.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prohibit embedding secrets or sensitive data in test code and related artifacts.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing in development and acceptance can detect sensitive data left in test code.

A.8.33 Test information mostly match
prevents

Explicit control on test information directly addresses inclusion of sensitive data in test environments.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC mandates review of test artifacts, reducing risk of sensitive data in test code.

A.8.28 Secure coding partial match
prevents

Secure coding standards can require scrubbing or exclusion of secrets from test modules.

A.8.31 Separation of development, test and production environments partial match
mitigates

Separation of dev/test/prod environments limits exposure of test code containing secrets.

References