Skip to content
CVE PROGRAM SOURCE RECORD6.4 Medium

CVE-2023-43655

Remote Code Execution via web-accessible composer.phar

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

composer composer

  • 2.6.4, 2.2.21, 1.10.27affected
  • >= 2.0, < 2.2.22affected
  • < 1.10.27affected

References