CVE-2018-11407 — Improper Authentication in Symfony

CWE-287 — Improper Authentication13 documents7 sources
Severity
9.8CRITICALNVD
EPSS
0.1%
top 65.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
SymfonySensiolabs SymfonySymfony Security+1 more
Timeline
PublishedJun 13
Latest updateMay 14

Description

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶Packagistsymfony/symfony2.8.0 — 2.8.37+3
▶Packagistsymfony/security2.8.0 — 2.8.37+3
▶NVDsensiolabs/symfony2.8.0 — 2.8.37+3
▶Packagistsymfony/security-core2.8.0 — 2.8.37+3
▶Debiansymfony/symfony< 3.4.12+dfsg-1+3

🔴Vulnerability Details

4
GHSA
Symfony Authentication Bypass↗2022-05-14
▶
OSV
Symfony Authentication Bypass↗2022-05-14
▶
CVEList
CVE-2018-11407: An issue was discovered in the Ldap component in Symfony 2↗2018-06-13
▶
OSV
CVE-2018-11407: An issue was discovered in the Ldap component in Symfony 2↗2018-06-13
▶

📋Vendor Advisories

2
Ubuntu
Symfony vulnerability↗2021-03-15
▶
Debian
CVE-2018-11407: symfony - An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3....↗2018
▶

💬Community

6
Bugzilla
CVE-2017-16652 CVE-2018-11385 CVE-2018-11386 CVE-2018-11406 CVE-2018-11407 CVE-2018-11408 php-symfony4: php-symfony: Multiple flaws [fedora-all]↗2018-06-15
▶
Bugzilla
CVE-2017-16652 CVE-2018-11385 CVE-2018-11386 CVE-2018-11406 CVE-2018-11407 CVE-2018-11408 php-symfony-symfony: php-symfony: Multiple flaws [epel-6]↗2018-06-15
▶
Bugzilla
CVE-2017-16652 CVE-2018-11385 CVE-2018-11386 CVE-2018-11406 CVE-2018-11407 CVE-2018-11408 php-symfony3: php-symfony: Multiple flaws [fedora-all]↗2018-06-15
▶
Bugzilla
CVE-2017-16652 CVE-2018-11385 CVE-2018-11386 CVE-2018-11406 CVE-2018-11407 CVE-2018-11408 php-symfony: Multiple flaws↗2018-06-14
▶
Bugzilla
CVE-2017-16652 CVE-2018-11385 CVE-2018-11386 CVE-2018-11406 CVE-2018-11407 CVE-2018-11408 php-symfony: Multiple flaws [fedora-all]↗2018-06-14
▶
CVE-2018-11407 — Improper Authentication in Symfony | cvebase