Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2016-2403

Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.

VectorNETWORK

PublishedFeb 07, 2017, 17:59

Published Bycve@mitre.org

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

symfony/security-core(Packagist)2.8.02.8.6N/A

symfony/security-core(Packagist)3.0.03.0.6N/A

symfony/security(Packagist)2.8.02.8.6N/A

symfony/security(Packagist)3.0.03.0.6N/A

symfony/symfony(Packagist)2.8.02.8.6N/A

symfony/symfony(Packagist)3.0.03.0.6N/A

References

http://symfony.com/blog/cve-2016-2403-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-password
http://www.securityfocus.com/bid/96137
https://www.debian.org/security/2018/dsa-4262

Weakness Type

CWE-287

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.0

Attack Vector (AV)

NETWORK