LiveActive security incident?Get immediate response
CVE Record

CVE-2015-8371: Composer before 2016-02-10 allows cache poisoning from other projects built on the same host.

Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist type, and certain other data from the package repository (which may simply be a commit hash, and thus can be found by an attacker). Versions through 1.0.0-alpha11 are affected, and 1.0.0 is unaffected.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Old pre-1.0 Composer builds could let one project on a shared build host poison Composer's cache so another project later pulls attacker-controlled code into its server-side build. The risk is mainly legacy CI or build infrastructure using affected Composer versions and shared caches.

Executive priority

Treat as a legacy supply-chain hygiene issue. Prioritize if PHP applications are built on shared infrastructure or old CI images. If Composer is modern and build caches are isolated, urgency is lower.

Technical view

Composer versions before the 2016-02-10 fix, including through 1.0.0-alpha11, derived dist package cache keys from predictable package repository data. On a host building multiple projects, this could allow cache poisoning across projects, causing untrusted package contents to enter a later build. Composer 1.0.0 is listed as unaffected.

Likely exposure

Exposure is most likely in legacy PHP build systems, old CI images, or shared build hosts that still use Composer alpha-era releases before 2016-02-10. Modern environments using Composer 1.0.0 or later are not indicated as affected by the source bundle.

Exploitation context

The source bundle does not indicate active exploitation, and the CVE is not in CISA KEV. Exploitation requires a shared build-host or shared-cache context where an attacker can influence another project built on the same host.

Researcher notes

The key condition is cross-project cache reuse on the same host. The provided sources do not include CVSS, CWE, exploit status, or detailed remediation beyond affected and unaffected Composer versions, so validation should focus on version and build-cache topology.

Mitigation direction

  • Upgrade Composer to 1.0.0 or a later unaffected release.
  • Check Composer and advisory guidance for exact fixed-version handling.
  • Avoid shared Composer caches across untrusted projects until remediated.
  • Rebuild affected CI images or build hosts using unaffected Composer.

Validation and detection

  • Inventory Composer versions in CI images, build hosts, and deployment pipelines.
  • Flag Composer versions through 1.0.0-alpha11 as affected.
  • Identify build systems sharing Composer cache across multiple projects.
  • Confirm production releases were built with unaffected Composer tooling.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2015-8371 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.