CVE-2024-24821
1 advisory.
Packagist/composer/composer CVE-2024-24821: high 8.8, EPSS 0.28%
Composer code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php
Action: Upgrade composer/composer to 2.2.23 or later.
composer require composer/composer:2.2.23composer require composer/composer:2.7.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0-alpha1 | 2.2.23 | - |
| 2.3.0-rc1 | 2.7.0 | - |
Fixed versions
| 2.2.23 | 2.7.0 |
Sources
- osv: GHSA-7c6p-848j-wh5h
- https://github.com/composer/composer/security/advisories/GHSA-7c6p-848j-wh5h
- https://nvd.nist.gov/vuln/detail/CVE-2024-24821
- https://github.com/composer/composer/commit/64e4eb356b159a30c766cd1ea83450a38dc23bf5
- https://github.com/composer/composer/commit/77e3982918bc1d886843dc3d5e575e7e871b27b7
- https://github.com/composer/composer
CVE-2024-24821 · published · modified · JSON