Detections
Analytics
Alpine: multiple composer packages: security update to 2.7.0-r0
high Tenable Cloud Security Plugin ID 408274
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Composer is a dependency Manager for the PHP language. In affected versions several files within the local
working directory are included during the invocation of Composer and in the context of the executing user.
As such, under certain conditions arbitrary code execution may lead to local privilege escalation, provide
lateral user movement or malicious code execution when Composer is invoked within a directory with
tampered files. All Composer CLI commands are affected, including composer.phar's self-update. The
following scenarios are of high risk: Composer being run with sudo, Pipelines which may execute Composer
on untrusted projects, Shared environments with developers who run Composer individually on the same
project. This vulnerability has been addressed in versions 2.7.0 and 2.2.23. It is advised that the
patched versions are applied at the earliest convenience. Where not possible, the following should be
addressed: Remove all sudo composer privileges for all users to mitigate root privilege escalation, and
avoid running Composer within an untrusted directory, or if needed, verify that the contents of
`vendor/composer/InstalledVersions.php` and `vendor/composer/installed.php` do not include untrusted code.
A reset can also be done on these files by the following:```sh rm vendor/composer/installed.php
vendor/composer/InstalledVersions.php composer install --no-scripts --no-plugins ``` (CVE-2024-24821)
See Also
Plugin Details
Severity: High
ID: 408274
Version: Revision 1.16
Type: Local
Published: 2/8/2024
Updated: 6/1/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.85
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2024-24821
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 2/8/2024
Reference Information
CVE: CVE-2024-24821