← Back to CVEs

CVE-2024-35242

HIGH

8.8

Description

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

CVE Details

CVSS v3.1 Score8.8

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published6/10/2024

Last Modified2/13/2025

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-77

References

https://github.com/composer/composer/commit/6bd43dff859c597c09bd03a7e7d6443822d0a396(security-advisories@github.com)

https://github.com/composer/composer/commit/fc57b93603d7d90b71ca8ec77b1c8a9171fdb467(security-advisories@github.com)

https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf(security-advisories@github.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/(security-advisories@github.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/(security-advisories@github.com)

https://github.com/composer/composer/commit/6bd43dff859c597c09bd03a7e7d6443822d0a396(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/composer/composer/commit/fc57b93603d7d90b71ca8ec77b1c8a9171fdb467(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.