PT-2016-3281 · Symfony · Symfony

Matteo Rossi · Publicado 2016-05-09 · Atualizado 2022-05-14 · CVE-2016-2403

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 2.8.6 Symfony versions 3.x prior to 3.0.6

Description The issue allows remote attackers to bypass authentication by logging in with an empty password and a valid username. This is due to errors in processing user authentication data, which can be exploited by a remote attacker to bypass the authentication procedure by specifying an existing username and an empty string as the password.

Recommendations For Symfony versions prior to 2.8.6, update to version 2.8.6 or later. For Symfony versions 3.x prior to 3.0.6, update to version 3.0.6 or later.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

BDU:2019-00442

CVE-2016-2403

DSA-4262-1

GHSA-WVJ5-R78R-HHFQ

Produtos afetados

Symfony

Referências · 38

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2016-2403.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-core/CVE-2016-2403.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2016-2403.yaml · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1665 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2403 · Nota de Segurança
• https://web.archive.org/web/20210123224944/http://securityfocus.com/bid/96137 · Nota
• https://ubuntu.com/security/CVE-2016-2403 · Aviso do Fabricante
• https://debian.org/security/2018/dsa-4262 · Aviso do Fabricante
• https://symfony.com/cve-2016-2403 · Nota
• https://security-tracker.debian.org/tracker/CVE-2016-2403 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-04114 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2016-2403 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-04244 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2016-2403 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11386 · Nota de Segurança