Lucene search

RedosROS-20240329-03

HistoryMar 29, 2024 - 12:00 a.m.

ROS-20240329-03

2024-03-2900:00:00

redos.red-soft.ru

vulnerability

php composer

dependency manager

arbitrary code execution

privilege escalation

unix

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

Confidence

Low

EPSS

Percentile

9.0%

JSON

Vulnerability in InstalledVersions.php and install.php scripts of dependency manager for PHP Composer is related to the inclusion of functions from an invalid controlled scope.
with the inclusion of functions from an invalid controlled scope. Exploitation of the vulnerability could allow
an attacker to execute arbitrary code and escalate privileges

OSVersionArchitecturePackageVersionFilename
redos7.3x86_64composer< 2.7.1-1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
redos	7.3	x86_64	composer	< 2.7.1-1	UNKNOWN

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for ROS-20240329-03