PT-2013-5765 · Friendsofsymfony · Fosuserbundle

Fabien Potencier · Published 2013-09-25 · Updated 2022-05-17 · CVE-2013-5750

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions FOSUserBundle versions prior to 1.3.3

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by submitting a long password to the login form. This triggers an expensive hash computation, such as a PBKDF2 computation.

Recommendations For versions prior to 1.3.3, update to version 1.3.3 or later to resolve the issue. As a temporary workaround, consider restricting the maximum password length to prevent excessive CPU consumption.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-399

CWE-400

Related Identifiers

CVE-2013-5750

GHSA-9MPF-G3FC-9RGV

Affected Products

Fosuserbundle

References · 5

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony/user-bundle/CVE-2013-5750.yaml · Exploit
• http://symfony.com/blog/cve-2013-5750-security-issue-in-fosuserbundle-login-form · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-5750 · Security Note
• https://osv.dev/vulnerability/GHSA-9mpf-g3fc-9rgv · Vendor Advisory
• https://symfony.com/cve-2013-5750 · Note