GitHub Advisoryadvisory · Packagist
GHSA-wvj5-r78r-hhfq Symfony Authentication Bypass
CRITICAL
Official page ↗
- Aliases
- CVE-2016-2403
- Ecosystem
- Packagist
- Packages
- symfony/security-core, symfony/security, symfony/symfony
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-287
- Reviewed
- 2023-07-31
Affected packages
• Packagist symfony/security-core: >= 2.8.0, < 2.8.6 → fixed in 2.8.6
• Packagist symfony/security-core: >= 3.0.0, < 3.0.6 → fixed in 3.0.6
• Packagist symfony/security: >= 2.8.0, < 2.8.6 → fixed in 2.8.6
• Packagist symfony/security: >= 3.0.0, < 3.0.6 → fixed in 3.0.6
• Packagist symfony/symfony: >= 2.8.0, < 2.8.6 → fixed in 2.8.6
• Packagist symfony/symfony: >= 3.0.0, < 3.0.6 → fixed in 3.0.6
Description
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
Related
Alias · CVE (1)
- CVE-2016-2403 Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid… vulnerability
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-2403 advisory
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-core/CVE-2016-2403.yaml web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2016-2403.yaml web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2016-2403.yaml web
- https://symfony.com/cve-2016-2403 web
- https://web.archive.org/web/20210123224944/http://www.securityfocus.com/bid/96137 web
- https://www.debian.org/security/2018/dsa-4262 web
- http://symfony.com/blog/cve-2016-2403-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-password web