CVE-2024-35242highCWE-77

CVE-2024-35242: fallo de gravedad alta en composer

Composer vulnerable to command injection via malicious git/hg branch names

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear composer+ Monitorear composer/composer

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 3.3%
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
composer · composer
CVEs relacionadas — composer

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-29472HIGHMissing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composerEPSS 4.8%CVE-2021-41116HIGHCommand injection in composer on WindowsEPSS 2.8%CVE-2022-24828HIGHMissing input validation can lead to command execution in composerEPSS 1.9%CVE-2026-40261HIGHComposer has Command Injection via Malicious Perforce ReferenceEPSS 1.7%CVE-2023-43655MEDIUMRemote Code Execution via web-accessible composer.pharEPSS 1.5%CVE-2024-35241HIGHComposer vulnerable to command injection via malicious git branch nameEPSS 1.1%