8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.5 High
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
15.7%
The composer install
command running inside a git/hg repository which has specially crafted branch names can lead to command injection. So this requires cloning untrusted repositories.
2.2.24 for 2.2 LTS or 2.7.7 for mainline
Avoid cloning potentially compromised repositories.
CPE | Name | Operator | Version |
---|---|---|---|
composer/composer | lt | 2.7.7 | |
composer/composer | lt | 2.2.24 |
github.com/advisories/GHSA-v9qv-c7wm-wgmf
github.com/composer/composer/commit/6bd43dff859c597c09bd03a7e7d6443822d0a396
github.com/composer/composer/commit/fc57b93603d7d90b71ca8ec77b1c8a9171fdb467
github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf
lists.fedoraproject.org/archives/list/[email protected]/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC
lists.fedoraproject.org/archives/list/[email protected]/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC
nvd.nist.gov/vuln/detail/CVE-2024-35242
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.5 High
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
15.7%