critical9.8
CVE-2016-2403
Symfony Authentication Bypass
Impact
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | symfony/security-core | >= 2.8.0, < 2.8.6 | 2.8.6 |
| composer | symfony/security | >= 2.8.0, < 2.8.6 | 2.8.6 |
| composer | symfony/symfony | >= 2.8.0, < 2.8.6 | 2.8.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sensiolabs | Symfony | Versions 2.8.0, 2.8.1, 2.8.2, 2.8.3, 2.8.4, 2.8.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://symfony.com/blog/cve-2016-2403-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-password
- http://www.securityfocus.com/bid/96137
- https://www.debian.org/security/2018/dsa-4262
- https://github.com/advisories/GHSA-wvj5-r78r-hhfq
- https://nvd.nist.gov/vuln/detail/CVE-2016-2403
- https://web.archive.org/web/20210123224944/http://www.securityfocus.com/bid/96137
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-core/CVE-2016-2403.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2016-2403.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2016-2403.yaml
- https://symfony.com/cve-2016-2403