Windows Setup
Approved changes feed: RSS · Atom
cpe:2.3:a:composer:windows-setup:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Composer (4426a153-3acd-58d1-a65e-e92269f84635) |
|---|---|
| Product | Windows Setup (ed030c13-173d-5630-a8cc-6a421e1fec70) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-15145 |
vulnerable | 2026-06-08 05:19:25.365983 |
Local privilege elevation in Composer-Setup for Windows
MEDIUM (6.7)
In Composer-Setup for Windows before version 6.0.0, if the developer's computer is shared with other users, a local attacker may be able to exploit the following scenarios. 1. A local regular user may modify the existing `C:\ProgramData\ComposerSetup\bin\composer.bat` in order to get elevated command execution when composer is run by an administrator. 2. A local regular user may create a specially crafted dll in the `C:\ProgramData\ComposerSetup\bin` folder in order to get Local System privileges. See: https://itm4n.github.io/windows-server-netman-dll-hijacking. 3. If the directory of the php.exe selected by the user is not in the system path, it is added without checking that it is admin secured, as per Microsoft guidelines. See: https://msrc-blog.microsoft.com/2018/04/04/triaging-a-dll-planting-vulnerability.
Published: 2020-08-14T16:35:13.000Z
Updated: 2024-08-04T13:08:21.821Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.