Code Execution

🗓️ 12 Jun 2024 06:25:27Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 16 Views

composer vulnerability code execution improper sanitizatio

Reporter	Title	Published	Views	Family All 64
FreeBSD	Composer -- Multiple command injections via malicious git/hg branch names	10 Jun 202400:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : composer (ALAS2023-2024-650)	11 Jul 202400:00	–	nessus
Tenable Nessus	Debian dla-3838 : composer - security update	20 Jun 202400:00	–	nessus
Tenable Nessus	Debian dsa-5715 : composer - security update	18 Jun 202400:00	–	nessus
Tenable Nessus	Fedora 40 : composer (2024-9ed24c98cd)	19 Jun 202400:00	–	nessus
Tenable Nessus	Fedora 39 : composer (2024-bb55f8476a)	20 Jun 202400:00	–	nessus
Tenable Nessus	FreeBSD : Composer -- Multiple command injections via malicious git/hg branch names (5f608c68-276c-11ef-8caa-0897988a1c07)	11 Jun 202400:00	–	nessus
Tenable Nessus	Tenable Security Center Multiple Vulnerabilities (TNS-2025-20)	2 Oct 202500:00	–	nessus
Tenable Nessus	SUSE SLES15 / openSUSE 15 Security Update : php-composer2 (SUSE-SU-2024:2106-1)	21 Jun 202400:00	–	nessus
Tenable Nessus	SUSE SLES15 / openSUSE 15 Security Update : php-composer2 (SUSE-SU-2024:2107-1)	21 Jun 202400:00	–	nessus

Vulners

Node

composer composerMatch1.10.13-1debian

AND

composer composerMatch2.0.9-1debian

AND

composer composerMatch2.0.9-2debian

AND

debian debian_linuxMatch999

composer composerMatch2.7.4-r0php

AND

composer composerMatch2.7.1-r0php

AND

composer composerMatch2.6.5-r0php

AND

composer composerMatch2.7.6-r0php

AND

alpinelinux alpine_linuxMatch3.19

composer composerMatch2.2.7-r0php

AND

composer composerMatch1.10.0-r0php

AND

composer composerMatch2.5.5-r0php

AND

composer composerMatch1.10.5-r0php

AND

composer composerMatch2.7.2-r0php

AND

composer composerMatch2.3.2-r0php

AND

composer composerMatch2.1.9-r1php

AND

composer composerMatch2.1.14-r0php

AND

composer composerMatch2.4.0_rc1-r0php

AND

composer composerMatch2.1.6-r0php

AND

composer composerMatch1.9.3-r0php

AND

composer composerMatch2.3.9-r0php

AND

composer composerMatch2.2.1-r0php

AND

composer composerMatch2.5.7-r0php

AND

composer composerMatch2.2.3-r0php

AND

composer composerMatch2.6.4-r0php

AND

composer composerMatch2.3.10-r0php

AND

composer composerMatch2.0.14-r0php

AND

composer composerMatch2.1.9-r0php

AND

composer composerMatch2.4.1-r0php

AND

composer composerMatch2.4.3-r0php

AND

composer composerMatch1.10.6-r0php

AND

composer composerMatch2.7.1-r0php

AND

composer composerMatch2.7.0-r0php

AND

composer composerMatch2.6.5-r0php

AND

composer composerMatch2.0.11-r0php

AND

composer composerMatch2.5.3-r1php

AND

composer composerMatch2.3.7-r0php

AND

composer composerMatch2.5.8-r0php

AND

composer composerMatch2.2.5-r0php

AND

composer composerMatch2.2.4-r0php

AND

composer composerMatch2.5.4-r0php

AND

composer composerMatch2.6.2-r0php

AND

composer composerMatch2.7.2-r1php

AND

composer composerMatch2.1.3-r0php

AND

composer composerMatch2.6.3-r0php

AND

composer composerMatch2.1.1-r0php

AND

composer composerMatch2.5.1-r0php

AND

composer composerMatch2.1.8-r0php

AND

composer composerMatch2.1.5-r0php

AND

composer composerMatch2.3.5-r0php

AND

composer composerMatch2.1.11-r0php

AND

composer composerMatch2.4.2-r0php

AND

composer composerMatch2.4.4-r0php

AND

composer composerMatch2.7.3-r0php

AND

composer composerMatch1.10.1-r0php

AND

composer composerMatch2.2.6-r0php

AND

composer composerMatch2.0.12-r0php

AND

composer composerMatch2.7.6-r0php

AND

composer composerMatch2.0.13-r0php

AND

alpinelinux alpine_linuxMatchedge

composer composerMatch2.7.6-r0php

AND

alpinelinux alpine_linuxMatch3.20

composer composerMatch2.0.9-1debian

AND

composer composerMatch1.10.13-1debian

AND

debian debian_linuxMatch11

composer composerMatch1.8.4-1+deb10u1debian

AND

debian debian_linuxMatch10

composer composer/composerRange2.0.0-alpha1–2.2.23php

composer composer/composerRange2.3.x-dev–2.7.6php

Source	Link
github	www.github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4
github	www.github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704
github	www.github.com/advisories/GHSA-47f6-5gq3-vx9c
github	www.github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/
vicarius	www.vicarius.io/vsociety/posts/cve-2024-35241-detect-composer-vulnerability
vicarius	www.vicarius.io/vsociety/posts/cve-2024-35241-mitigate-vulnerable-composer

21 Apr 2025 18:20Current

8High risk

Vulners AI Score8

CVSS 3.18.8

EPSS0.00442

SSVC