CVE-2024-35241

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-352428.8Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running insid CVE-2024-352449.1There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by CVE-2024-352456.7Uncontrolled search path element in some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an authenticated CVE-2024-352467.5An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly.CVE-2024-352475.5In the Linux kernel, the following vulnerability has been resolved: fpga: region: add owner module and take its refcount The current imple CVE-2024-352487.3Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability CVE-2024-352498.8Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability CVE-2024-35255.4A vulnerability, which was classified as problematic, was found in Campcodes Online Event Management System 1.0. Affected is an unknown func CVE-2024-352507.8Windows Kernel-Mode Driver Elevation of Privilege Vulnerability CVE-2024-352527.5Azure Storage Movement Client Library Denial of Service Vulnerability CVE-2024-352534.4Microsoft Azure File Sync Elevation of Privilege Vulnerability CVE-2024-352547.1Azure Monitor Agent Elevation of Privilege Vulnerability