CVE-2016-2403
published 2017-02-07CVE-2016-2403: Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which…
PriorityP359critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
2.93%
85.6th percentile
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
Affected
44 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | symfony | < symfony 3.4.12+dfsg-1 (bookworm) | symfony 3.4.12+dfsg-1 (bookworm) |
| debian | symfony | < symfony 2.8.6+dfsg-1 (bookworm) | symfony 2.8.6+dfsg-1 (bookworm) |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | >= 2.8.0 < 2.8.37 | 2.8.37 |
| sensiolabs | symfony | >= 3.3.0 < 3.3.17 | 3.3.17 |
| sensiolabs | symfony | >= 3.4.0 < 3.4.7 | 3.4.7 |
| sensiolabs | symfony | >= 4.0.0 < 4.0.7 | 4.0.7 |
| symfony | security | >= 2.8.0 < 2.8.6 | 2.8.6 |
| symfony | security | >= 2.8.0 < 2.8.37 | 2.8.37 |
| symfony | security | >= 3.0.0 < 3.0.6 | 3.0.6 |
| symfony | security | >= 3.0.0 < 3.3.17 | 3.3.17 |
| symfony | security | >= 3.4.0 < 3.4.7 | 3.4.7 |
| symfony | security | >= 4.0.0 < 4.0.7 | 4.0.7 |
| symfony | security-core | >= 2.8.0 < 2.8.6 | 2.8.6 |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_debian9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Symfony Authentication Bypass
ghsa·2022-05-14
CVE-2016-2403 [CRITICAL] CWE-287 Symfony Authentication Bypass
Symfony Authentication Bypass
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
GHSA
Symfony Authentication Bypass
ghsa·2022-05-14·CVSS 9.8
CVE-2018-11407 [CRITICAL] CWE-287 Symfony Authentication Bypass
Symfony Authentication Bypass
An issue was discovered in the LDAP component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. **NOTE:** this issue exists because of an incomplete fix for CVE-2016-2403.
OSV
Symfony Authentication Bypass
osv·2022-05-14·CVSS 9.8
CVE-2018-11407 [CRITICAL] Symfony Authentication Bypass
Symfony Authentication Bypass
An issue was discovered in the LDAP component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. **NOTE:** this issue exists because of an incomplete fix for CVE-2016-2403.
OSV
Symfony Authentication Bypass
osv·2022-05-14
CVE-2016-2403 [CRITICAL] Symfony Authentication Bypass
Symfony Authentication Bypass
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
OSV
CVE-2018-11407: An issue was discovered in the Ldap component in Symfony 2
osv·2018-06-13·CVSS 9.8
CVE-2018-11407 [CRITICAL] CVE-2018-11407: An issue was discovered in the Ldap component in Symfony 2
An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.
OSV
CVE-2016-2403: Symfony before 2
osv·2017-02-07·CVSS 9.8
CVE-2016-2403 [CRITICAL] CVE-2016-2403: Symfony before 2
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
Debian
CVE-2018-11407: symfony - An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3....
vendor_debian·2018·CVSS 9.8
CVE-2018-11407 [CRITICAL] CVE-2018-11407: symfony - An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3....
An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.
Scope: local
bookworm: resolved (fixed in 3.4.12+dfsg-1)
bullseye: resolved (fixed in 3.4.12+dfsg-1)
forky: resolved (fixed in 3.4.12+dfsg-1)
sid: resolved (fixed in 3.4.12+dfsg-1)
trixie: resolved (fixed in 3.4.12+dfsg-1)
Debian
CVE-2016-2403: symfony - Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass auth...
vendor_debian·2016·CVSS 9.8
CVE-2016-2403 [CRITICAL] CVE-2016-2403: symfony - Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass auth...
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
Scope: local
bookworm: resolved (fixed in 2.8.6+dfsg-1)
bullseye: resolved (fixed in 2.8.6+dfsg-1)
forky: resolved (fixed in 2.8.6+dfsg-1)
sid: resolved (fixed in 2.8.6+dfsg-1)
trixie: resolved (fixed in 2.8.6+dfsg-1)
No detection rules found.
No public exploits indexed.
http://symfony.com/blog/cve-2016-2403-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-passwordhttp://www.securityfocus.com/bid/96137https://www.debian.org/security/2018/dsa-4262http://symfony.com/blog/cve-2016-2403-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-passwordhttp://www.securityfocus.com/bid/96137https://www.debian.org/security/2018/dsa-4262
2017-02-07
Published