CVE-2015-8371: getcomposer composer
Vulnerability summary
CVE-2015-8371 is a high (CVSS 8.8) vulnerability in getcomposer composer. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53.1% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 21-09-2023PublishedVulnerability first disclosed.
- 25-09-2024Last modifiedVulnerability information updated.
Description
Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist type, and certain other data from the package repository (which may simply be a commit hash, and thus can be found by an attacker). Versions through 1.0.0-alpha11 are affected, and 1.0.0 is unaffected.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.72%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
+0.03 pp
From 0.70% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (flyingmana.de)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- composer< 1.0.0~alpha11-3
Getcomposer1 product
- composerEOL1.0.0:alpha1 | 1.0.0:alpha10 | 1.0.0:alpha11 | 1.0.0:alpha2 | 1.0.0:alpha3 | 1.0.0:alpha4 | 1.0.0:alpha5 | 1.0.0:alpha6 | 1.0.0:alpha7 | 1.0.0:alpha8 | 1.0.0:alpha9
Ubuntu1 product
- composer< 1.0.0~beta2-1
3 vendors · 3 products
References
8 links- flyingmana.de/blog_en/2016/02/14/composer_cache_injection_vulnerability_cve_2015_8371.htmlExploitThird Party Advisory
- github.com/FriendsOfPHP/…Third Party Advisory
- github.com/composer/composerProduct
