Veracode Vulnerability DatabaseVERACODE:43455Remote Code Execution (RCE)
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.005 Low
EPSS
Percentile
76.0%
composer/composer is vulnerable to Remote Code Execution (RCE). The vulnerability exists because the register_argc_argv is not properly disabled in php.ini, which allows an attacker to inject and execute malicious code through the malicious composer.phar file when publishing a composer.phar to a public web-accessible server
References
github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6120d
github.com/composer/composer/commit/955a48e6319c8962e5cd421b07c00ab3c728968c
github.com/composer/composer/commit/95e091c921037b7b6564942845e7b738f6b95c9c
github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf
lists.debian.org/debian-lts-announce/2024/03/msg00030.html
lists.fedoraproject.org/archives/list/[email protected]/message/66H2WKFUO255T3BZTL72TNYJYH2XM5FG/
lists.fedoraproject.org/archives/list/[email protected]/message/7AWYAUZNH565NWPIKGEIYBWHYNM5JGAE/
lists.fedoraproject.org/archives/list/[email protected]/message/KFOPGPW2KS37O3KJWBRGTUWHTXCQXBS2/
secdb.alpinelinux.org/edge/community.yaml
secdb.alpinelinux.org/v3.18/community.yaml
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.005 Low
EPSS
Percentile
76.0%