CVE-2021-41116 - Vulnerability Details - OpenCVE

ReportizFlow

Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Getcomposer	Composer
Tenable	Tenable.sc

Configuration 1 [-]

OR	cpe:2.3:a:getcomposer:composer::::::::
	cpe:2.3:a:getcomposer:composer::::::::

Configuration 2 [-]

cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa
https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf
https://www.sonarsource.com/blog/securing-developer-tools-package-managers/

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2021-10-05T17:40:10

Updated: 2024-08-04T02:59:31.440Z

Reserved: 2021-09-15T00:00:00

Link: CVE-2021-41116

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-10-05T18:15:08.407

Modified: 2024-11-21T06:25:30.167

Link: CVE-2021-41116

Redhat

No data.

{"containers": {"cna": {"title": "Command injection in composer on Windows", "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "lang": "en", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf"}, {"name": "https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa", "tags": ["x_refsource_MISC"], "url": "https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa"}, {"name": "https://www.sonarsource.com/blog/securing-developer-tools-package-managers/", "tags": ["x_refsource_MISC"], "url": "https://www.sonarsource.com/blog/securing-developer-tools-package-managers/"}], "affected": [{"vendor": "composer", "product": "composer", "versions": [{"version": "< 1.10.23", "status": "affected"}, {"version": ">= 2.0, < 2.1.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-10-24T23:04:26.576Z"}, "descriptions": [{"lang": "en", "value": "Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue."}], "source": {"advisory": "GHSA-frqg-7g38-6gcf", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T02:59:31.440Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf"}, {"name": "https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa"}, {"name": "https://www.sonarsource.com/blog/securing-developer-tools-package-managers/", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.sonarsource.com/blog/securing-developer-tools-package-managers/"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-41116", "datePublished": "2021-10-05T17:40:10", "dateReserved": "2021-09-15T00:00:00", "dateUpdated": "2024-08-04T02:59:31.440Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*", "matchCriteriaId": "9C5AC58B-D753-4639-B1FA-6267EE5EC280", "versionEndExcluding": "1.10.23", "vulnerable": true}, {"criteria": "cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*", "matchCriteriaId": "24022E9F-FD26-4F38-8CAA-17B5DA3AB005", "versionEndExcluding": "2.1.9", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*", "matchCriteriaId": "CAB9A41F-91F1-40DF-BF12-6ADA7229A84C", "versionEndExcluding": "5.21.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue."}, {"lang": "es", "value": "Composer es un administrador de dependencias de c\u00f3digo abierto para el lenguaje PHP. En las versiones afectadas, unos usuarios de Windows que ejecutan Composer para instalar dependencias no confiables est\u00e1n sujetos a una inyecci\u00f3n de comandos y deben actualizar su versi\u00f3n de Composer. Otros Sistemas Operativos y WSL no est\u00e1n afectados. El problema ha sido resuelto en Composer versiones 1.10.23 y 2.1.9. No se presentan soluciones para este problema"}], "id": "CVE-2021-41116", "lastModified": "2024-11-21T06:25:30.167", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2021-10-05T18:15:08.407", "references": [{"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf"}, {"source": "[email protected]", "url": "https://www.sonarsource.com/blog/securing-developer-tools-package-managers/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.sonarsource.com/blog/securing-developer-tools-package-managers/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-77"}], "source": "[email protected]", "type": "Primary"}]}