← Zuruck zu CVEs

CVE-2024-35242

HIGH

8.8

Beschreibung

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

CVE Details

CVSS v3.1 Bewertung8.8

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionREQUIRED

Veroffentlicht6/10/2024

Zuletzt geandert2/13/2025

Quellenvd

Honeypot-Sichtungen0

Schwachen (CWE)

CWE-77

Referenzen

https://github.com/composer/composer/commit/6bd43dff859c597c09bd03a7e7d6443822d0a396(security-advisories@github.com)

https://github.com/composer/composer/commit/fc57b93603d7d90b71ca8ec77b1c8a9171fdb467(security-advisories@github.com)

https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf(security-advisories@github.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/(security-advisories@github.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/(security-advisories@github.com)

https://github.com/composer/composer/commit/6bd43dff859c597c09bd03a7e7d6443822d0a396(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/composer/composer/commit/fc57b93603d7d90b71ca8ec77b1c8a9171fdb467(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.