« Volver al listado

CVE-2024-35241

Estado: AplazadaAlta (8.8)—

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Composer — ComposerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-35241",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-35241",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-15T20:42:58.759423Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "composer",
          "product": "composer",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.0, < 2.2.24"
            },
            {
              "status": "affected",
              "version": ">= 2.3, < 2.7.7"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
            "cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*"
          ],
          "vendor": "fedoraproject",
          "product": "fedora",
          "versions": [
            {
              "status": "affected",
              "version": "39"
            },
            {
              "status": "affected",
              "version": "40"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:getcomposer:composer:2.0:*:*:*:*:*:*:*"
          ],
          "vendor": "getcomposer",
          "product": "composer",
          "versions": [
            {
              "status": "affected",
              "version": "2.0",
              "lessThan": "2.2.24",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:getcomposer:composer:2.3:*:*:*:*:*:*:*"
          ],
          "vendor": "getcomposer",
          "product": "composer",
          "versions": [
            {
              "status": "affected",
              "version": "2.3",
              "lessThan": "2.7.7",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-06-10T22:15:09.677",
  "references": [
    {
      "url": "https://github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.vicarius.io/vsociety/posts/cve-2024-35241-detect-composer-vulnerability",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.vicarius.io/vsociety/posts/cve-2024-35241-mitigate-vulnerable-composer",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting."
    },
    {
      "lang": "es",
      "value": "Composer es un administrador de dependencias para PHP. En la rama 2.x anterior a las versiones 2.2.24 y 2.7.7, los comandos `status`, `reinstall` y `remove` con paquetes instalados desde el código fuente a través de git que contienen nombres de ramas especialmente manipulados en el repositorio se pueden usar para ejecutar código. Los parches para este problema están disponibles en la versión 2.2.24 para 2.2 LTS o 2.7.7 para la línea principal. Como workaround, evite instalar dependencias a través de git usando `--prefer-dist` o la configuración de configuración `preferred-install: dist`."
    }
  ],
  "lastModified": "2026-06-17T07:34:36.580",
  "sourceIdentifier": "security-advisories@github.com"
}