Vulnerabilities > CVE-2023-43655

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

getcomposer

fedoraproject

NVD

Published: 2023-09-29

Updated: 2024-11-21

Summary

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

Vulnerable Configurations

Part	Description	Count
Application	Getcomposer Getcomposer Composer 2.3.0 Getcomposer Composer 2.3.1 Getcomposer Composer 2.3.2 Getcomposer Composer 2.3.3 Getcomposer Composer 2.3.4 Getcomposer Composer 2.3.5 Getcomposer Composer 2.3.6 Getcomposer Composer 2.3.7 Getcomposer Composer 2.3.8 Getcomposer Composer 2.3.9 Getcomposer Composer 2.3.10 Getcomposer Composer 2.4.0 Getcomposer Composer 2.4.1 Getcomposer Composer 2.4.2 Getcomposer Composer 2.4.3 Getcomposer Composer 2.4.4 Getcomposer Composer 2.5.0 Getcomposer Composer 2.5.1 Getcomposer Composer 2.5.2 Getcomposer Composer 2.5.3 Getcomposer Composer 2.5.4 Getcomposer Composer 2.5.5 Getcomposer Composer 2.5.6 Getcomposer Composer 2.5.7 Getcomposer Composer 2.5.8 Getcomposer Composer 2.6.0 Getcomposer Composer 2.6.1 Getcomposer Composer 2.6.2 Getcomposer Composer 2.6.3 Getcomposer Composer 2.0.0 Getcomposer Composer 2.0.1 Getcomposer Composer 2.0.2 Getcomposer Composer 2.0.3 Getcomposer Composer 2.0.4 Getcomposer Composer 2.0.5 Getcomposer Composer 2.0.6 Getcomposer Composer 2.0.7 Getcomposer Composer 2.0.8 Getcomposer Composer 2.0.9 Getcomposer Composer 2.0.10 Getcomposer Composer 2.0.11 Getcomposer Composer 2.0.12 Getcomposer Composer 2.0.13 Getcomposer Composer 2.0.14 Getcomposer Composer 2.1.0 Getcomposer Composer 2.1.1 Getcomposer Composer 2.1.2 Getcomposer Composer 2.1.3 Getcomposer Composer 2.1.4 Getcomposer Composer 2.1.5 Getcomposer Composer 2.1.6 Getcomposer Composer 2.1.7 Getcomposer Composer 2.1.8 Getcomposer Composer 2.1.9 Getcomposer Composer 2.1.10 Getcomposer Composer 2.1.11 Getcomposer Composer 2.1.12 Getcomposer Composer 2.1.14 Getcomposer Composer 2.2.0 Getcomposer Composer 2.2.1 Getcomposer Composer 2.2.2 Getcomposer Composer 2.2.3 Getcomposer Composer 2.2.4 Getcomposer Composer 2.2.5 Getcomposer Composer 2.2.6 Getcomposer Composer 2.2.7 Getcomposer Composer 2.2.8 Getcomposer Composer 2.2.9 Getcomposer Composer 2.2.10 Getcomposer Composer 2.2.11 Getcomposer Composer 2.2.12 Getcomposer Composer 2.2.13 Getcomposer Composer 2.2.14 Getcomposer Composer 2.2.15 Getcomposer Composer 2.2.16 Getcomposer Composer 2.2.17 Getcomposer Composer 2.2.18 Getcomposer Composer 2.2.19 Getcomposer Composer 2.2.20 Getcomposer Composer - Getcomposer Composer 1.0.0 Getcomposer Composer 1.0.1 Getcomposer Composer 1.0.2 Getcomposer Composer 1.0.3 Getcomposer Composer 1.1.0 Getcomposer Composer 1.1.1 Getcomposer Composer 1.1.2 Getcomposer Composer 1.1.3 Getcomposer Composer 1.2.0 Getcomposer Composer 1.2.1 Getcomposer Composer 1.2.2 Getcomposer Composer 1.2.3 Getcomposer Composer 1.2.4 Getcomposer Composer 1.3.0 Getcomposer Composer 1.3.1 Getcomposer Composer 1.3.2 Getcomposer Composer 1.3.3 Getcomposer Composer 1.4.0 Getcomposer Composer 1.4.1 Getcomposer Composer 1.4.2 Getcomposer Composer 1.4.3 Getcomposer Composer 1.5.0 Getcomposer Composer 1.5.1 Getcomposer Composer 1.5.2 Getcomposer Composer 1.5.3 Getcomposer Composer 1.5.4 Getcomposer Composer 1.5.5 Getcomposer Composer 1.5.6 Getcomposer Composer 1.6.0 Getcomposer Composer 1.6.1 Getcomposer Composer 1.6.2 Getcomposer Composer 1.6.3 Getcomposer Composer 1.6.4 Getcomposer Composer 1.6.5 Getcomposer Composer 1.7.0 Getcomposer Composer 1.7.1 Getcomposer Composer 1.7.2 Getcomposer Composer 1.7.3 Getcomposer Composer 1.8.0 Getcomposer Composer 1.8.1 Getcomposer Composer 1.8.2 Getcomposer Composer 1.8.3 Getcomposer Composer 1.8.4 Getcomposer Composer 1.8.5 Getcomposer Composer 1.8.6 Getcomposer Composer 1.9.0 Getcomposer Composer 1.9.1 Getcomposer Composer 1.9.2 Getcomposer Composer 1.9.3 Getcomposer Composer 1.10.0 Getcomposer Composer 1.10.1 Getcomposer Composer 1.10.2 Getcomposer Composer 1.10.3 Getcomposer Composer 1.10.4 Getcomposer Composer 1.10.5 Getcomposer Composer 1.10.6 Getcomposer Composer 1.10.7 Getcomposer Composer 1.10.8 Getcomposer Composer 1.10.9 Getcomposer Composer 1.10.10 Getcomposer Composer 1.10.11 Getcomposer Composer 1.10.12 Getcomposer Composer 1.10.13 Getcomposer Composer 1.10.14 Getcomposer Composer 1.10.15 Getcomposer Composer 1.10.16 Getcomposer Composer 1.10.17 Getcomposer Composer 1.10.18 Getcomposer Composer 1.10.19 Getcomposer Composer 1.10.20 Getcomposer Composer 1.10.21 Getcomposer Composer 1.10.22 Getcomposer Composer 1.10.23 Getcomposer Composer 1.10.24 Getcomposer Composer 1.10.25 Getcomposer Composer 1.10.26	183
OS	Fedoraproject Fedoraproject Fedora 37 Fedoraproject Fedora 38	2

Vulnerabilities > CVE-2023-43655 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2023-43655"}]}

Summary

Vulnerable Configurations

References

Vulnerabilities > CVE-2023-43655