CVE-2022-24828

🗓️ 13 Apr 2022 21:00:22Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 169 Views

Composer dependency manager for PHP. Integrators using Composer code can have code injection vulnerability if user controls $file or $identifier args. Vulnerability patched on packagist.org and Private Packagist

Reporter	Title	Published	Views	Family All 55
FreeBSD	Composer -- Command injection vulnerability	13 Apr 202200:00	–	freebsd
AlpineLinux	CVE-2022-24828	13 Apr 202221:00	–	alpinelinux
AstraLinux	Astra Linux - уязвимость в composer	3 May 202623:59	–	astralinux
Circl	CVE-2022-24828	14 Apr 202200:18	–	circl
CNNVD	composer 参数注入漏洞	13 Apr 202200:00	–	cnnvd
Cvelist	CVE-2022-24828 Missing input validation can lead to command execution in composer	13 Apr 202221:00	–	cvelist
Debian CVE	CVE-2022-24828	13 Apr 202221:00	–	debiancve
EUVD	EUVD-2022-1866	3 Oct 202520:07	–	euvd
Fedora	[SECURITY] Fedora 34 Update: composer-2.2.12-1.fc34	21 Apr 202220:57	–	fedora
Fedora	[SECURITY] Fedora 35 Update: composer-2.3.5-1.fc35	21 Apr 202221:22	–	fedora

NVD

Vulners

Node

getcomposer composerRange<1.10.26

getcomposer composerRange2.0.0–2.2.12

getcomposer composerRange2.3.0–2.3.5

Node

tenable tenable.scRange<5.21.0

Node

fedoraproject fedoraMatch34

fedoraproject fedoraMatch35

fedoraproject fedoraMatch36

[
  {
    "product": "composer",
    "vendor": "composer",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.10.26"
      },
      {
        "status": "affected",
        "version": ">= 2.0.0, < 2.2.12"
      },
      {
        "status": "affected",
        "version": ">= 2.3, < 2.3.6"
      }
    ]
  }
]

Source	Link
tenable	www.tenable.com/security/tns-2022-09
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QD7JQWL6C4GVROO25DTXWYWM6BPOPPCG/
github	www.github.com/composer/composer/security/advisories/GHSA-x7cr-6qr6-2hh6
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWT6LDSRY7SFMTDZWJ4MS2ZBXHL7VQEF/
github	www.github.com/composer/composer/commit/2c40c53637c5c7e43fff7c09d3d324d632734709
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/625MT3IKWKFVIWLSYZFSXHVUA2LES7YQ/

21 Nov 2024 06:51Current

8.7High risk

Vulners AI Score8.7

CVSS 26.8

CVSS 3.18.3 - 8.8

EPSS0.00167