CVE-2020-15145

In Composer-Setup for Windows before version 6.0.0, if the developer's computer is shared with other users, a local attacker may be able to exploit the following scenarios. 1. A local regular user may modify the existing `C:\ProgramData\ComposerSetup\bin\composer.bat` in order to get elevated command execution when composer is run by an administrator. 2. A local regular user may create a specially crafted dll in the `C:\ProgramData\ComposerSetup\bin` folder in order to get Local System privileges. See: https://itm4n.github.io/windows-server-netman-dll-hijacking. 3. If the directory of the php.exe selected by the user is not in the system path, it is added without checking that it is admin secured, as per Microsoft guidelines. See: https://msrc-blog.microsoft.com/2018/04/04/triaging-a-dll-planting-vulnerability.

• CVE ID
• CVE-2020-15145

• Assigner
• security-advisories@github.com

• Vulnerability Status
• Analyzed

• Published Version
• 2020-08-14T17:15:14

• Last Modified Date
• 2020-08-21T14:54:05

• Version
• 2.0

• Vector String
• AV:L/AC:M/Au:N/C:P/I:P/A:P

• Access Vector
• LOCAL

• Access Compatibility
• MEDIUM

• Authentication
• NONE

• Confidentiality Impact
• PARTIAL

• Integrity Impact
• PARTIAL

• Availability Impact
• PARTIAL

• Base Score
• 4.4

• Severity
• MEDIUM

• Exploitability Score
• 3.4

• Impact Score
• 6.4

• Version
• 3.1

• Vector String
• CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

• Attack Vector
• LOCAL

• Attack Compatibility
• LOW

• Privileges Required
• LOW

• User Interaction
• REQUIRED

• Scope
• CHANGED

• Confidentiality Impact
• HIGH

• Availability Impact
• HIGH

• Base Score
• 8.2

• Base Severity
• HIGH

• Exploitability Score
• 1.5

• Impact Score
• 6