← Volver a CVEs

CVE-2024-35242

HIGH

8.8

Descripcion

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

Detalles CVE

Puntuacion CVSS v3.18.8

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado6/10/2024

Ultima modificacion2/13/2025

Fuentenvd

Avistamientos honeypot0

Debilidades (CWE)

CWE-77

Referencias

https://github.com/composer/composer/commit/6bd43dff859c597c09bd03a7e7d6443822d0a396(security-advisories@github.com)

https://github.com/composer/composer/commit/fc57b93603d7d90b71ca8ec77b1c8a9171fdb467(security-advisories@github.com)

https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf(security-advisories@github.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/(security-advisories@github.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/(security-advisories@github.com)

https://github.com/composer/composer/commit/6bd43dff859c597c09bd03a7e7d6443822d0a396(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/composer/composer/commit/fc57b93603d7d90b71ca8ec77b1c8a9171fdb467(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.