Remote Code Execution (RCE)

🗓️ 14 Apr 2022 07:25:40Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 109 Views

Remote Code Execution in composer/compose

Reporter	Title	Published	Views	Family All 56
FreeBSD	Composer -- Command injection vulnerability	13 Apr 202200:00	–	freebsd
AlpineLinux	CVE-2022-24828	13 Apr 202221:00	–	alpinelinux
AstraLinux	Astra Linux – Vulnerability in Composer	19 Jun 202611:10	–	astralinux
BDU FSTEC	The vulnerability of the implementation of the VcsDriver::getFileContent() method in the dependency manager for PHP Composer allows a perpetrator to execute arbitrary commands.	17 May 202200:00	–	bdu_fstec
Circl	CVE-2022-24828	14 Apr 202200:18	–	circl
CNNVD	composer 参数注入漏洞	13 Apr 202200:00	–	cnnvd
CVE	CVE-2022-24828	13 Apr 202221:00	–	cve
Cvelist	CVE-2022-24828 Missing input validation can lead to command execution in composer	13 Apr 202221:00	–	cvelist
Debian CVE	CVE-2022-24828	13 Apr 202221:00	–	debiancve
EUVD	EUVD-2022-1866	3 Oct 202520:07	–	euvd

Vulners

Node

composer composerMatch2.0.14-r0php

AND

composer composerMatch2.0.11-r0php

AND

composer composerMatch2.2.3-r0php

AND

composer composerMatch2.0.13-r0php

AND

composer composerMatch2.1.8-r0php

AND

composer composerMatch1.10.0-r0php

AND

composer composerMatch2.1.5-r0php

AND

composer composerMatch2.0.12-r0php

AND

composer composerMatch2.1.6-r0php

AND

composer composerMatch2.1.1-r0php

AND

composer composerMatch2.1.9-r1php

AND

composer composerMatch2.2.5-r0php

AND

composer composerMatch2.2.6-r0php

AND

composer composerMatch2.2.1-r0php

AND

composer composerMatch2.1.11-r0php

AND

composer composerMatch2.1.9-r0php

AND

composer composerMatch2.1.3-r0php

AND

composer composerMatch1.9.3-r0php

AND

composer composerMatch1.10.5-r0php

AND

composer composerMatch2.1.14-r0php

AND

composer composerMatch1.10.1-r0php

AND

composer composerMatch2.3.2-r0php

AND

composer composerMatch2.2.4-r0php

AND

composer composerMatch2.2.7-r0php

AND

composer composerMatch1.10.6-r0php

AND

alpinelinux alpine_linuxMatchedge

composer composerMatch2.1.12-r0php

AND

composer composerMatch2.1.9-r1php

AND

composer composerMatch2.1.11-r0php

AND

alpinelinux alpine_linuxMatch3.15

composer composerMatch1.10.13-1debian

AND

composer composerMatch2.0.9-2debian

AND

composer composerMatch2.0.9-1debian

AND

debian debian_linuxMatch999

composer composerMatch1.10.13-1debian

AND

composer composerMatch2.0.9-1debian

AND

debian debian_linuxMatch11

composer composerMatch1.8.4-1+deb10u1debian

AND

debian debian_linuxMatch10

composer composer/composerRange1.3.0-RC–1.10.25php

composer composer/composerRange2.3.0-RC1–2.3.4php

composer composer/composerRange2.0.0-alpha1–2.2.11php

Source	Link
github	www.github.com/composer/composer/commit/2c40c53637c5c7e43fff7c09d3d324d632734709
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWT6LDSRY7SFMTDZWJ4MS2ZBXHL7VQEF/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/GWT6LDSRY7SFMTDZWJ4MS2ZBXHL7VQEF/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/625MT3IKWKFVIWLSYZFSXHVUA2LES7YQ/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/625MT3IKWKFVIWLSYZFSXHVUA2LES7YQ/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/QD7JQWL6C4GVROO25DTXWYWM6BPOPPCG/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QD7JQWL6C4GVROO25DTXWYWM6BPOPPCG/
github	www.github.com/composer/composer/security/advisories/GHSA-x7cr-6qr6-2hh6
tenable	www.tenable.com/security/tns-2022-09

07 Nov 2023 22:19Current

5.1Medium risk

Vulners AI Score5.1

CVSS 3.18.3 - 8.8

CVSS 26.8

EPSS0.01841