CVE-2023-43655CWE-74

Remote Code Execution via web-accessible composer.phar

Medium · published September 29, 2023

CVSS v3.1
6.4
EPSS
2%
Percentile
74.6
In the wild
Unconfirmed
What it is

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01532 · 74.6th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2023-09-29T19:33Z
EPSS history
Timeline
  • 29 SEP 19:33Z
    Remote Code Execution via web-accessible composer.phar
    cvelistv5