PT-2013-5765 · Friendsofsymfony · Fosuserbundle

Fabien Potencier · Publicado 2013-09-25 · Atualizado 2022-05-17 · CVE-2013-5750

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions FOSUserBundle versions prior to 1.3.3

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by submitting a long password to the login form. This triggers an expensive hash computation, such as a PBKDF2 computation.

Recommendations For versions prior to 1.3.3, update to version 1.3.3 or later to resolve the issue. As a temporary workaround, consider restricting the maximum password length to prevent excessive CPU consumption.

Exploit

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-399

CWE-400

Identificadores relacionados

CVE-2013-5750

GHSA-9MPF-G3FC-9RGV

Produtos afetados

Fosuserbundle

Referências · 5

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony/user-bundle/CVE-2013-5750.yaml · Exploit
• http://symfony.com/blog/cve-2013-5750-security-issue-in-fosuserbundle-login-form · Aviso do Fabricante
• https://symfony.com/cve-2013-5750 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-5750 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-9mpf-g3fc-9rgv · Aviso do Fabricante