CVE-2020-15145

🗓️ 14 Aug 2020 16:35:13Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 47 Views🌐 WEB

In Composer-Setup for Windows <6.0.0, local attackers may exploit DLL hijacking and command execution scenarios

Reporter	Title	Published	Views	Family All 5
Cvelist	CVE-2020-15145 Local privilege elevation in Composer-Setup for Windows	14 Aug 202016:35	–	cvelist
EUVD	EUVD-2020-7231	7 Oct 202500:30	–	euvd
NVD	CVE-2020-15145	14 Aug 202017:15	–	nvd
Prion	Design/Logic Flaw	14 Aug 202017:15	–	prion
RedhatCVE	CVE-2020-15145	22 May 202516:22	–	redhatcve

NVD

Vulners

Node

getcomposer composer-setupRange<6.0.0windows

[
  {
    "product": "windows-setup",
    "vendor": "composer",
    "versions": [
      {
        "status": "affected",
        "version": "< 6.0.0"
      }
    ]
  }
]

Source	Link
github	www.github.com/composer/windows-setup/commit/ca9f1435d368e3377e82d60ef0c7b795afa9f804
github	www.github.com/composer/windows-setup/security/advisories/GHSA-wgrx-r3qv-332c

Parameter	Position	Path	Description	CWE
composer.bat	path	C:\ProgramData\ComposerSetup\bin\composer.bat	Local attacker may modify composer.bat to achieve elevated command execution when run by an administrator	CWE-276
dll hijacking	path	C:\ProgramData\ComposerSetup\bin	Local attacker may place a crafted dll in the bin directory to obtain Local System privileges via DLL hijacking	CWE-276
admin-secured path handling	path	C:\ProgramData\ComposerSetup\bin	If php.exe directory is not in system path, it may be added without admin safeguards, enabling privilege escalation vectors	CWE-276
php.exe path insertion	path	C:\ProgramData\ComposerSetup\bin	If php.exe directory is not in system path, it may be added without admin safeguards, enabling privilege escalation vectors	CWE-276

21 Nov 2024 05:04Current

7.2High risk

Vulners AI Score7.2

CVSS 24.4

CVSS 3.16.7 - 8.2

EPSS0.00047

CWE-276