PT-2016-3281 · Symfony · Symfony

Matteo Rossi · Published 2016-05-09 · Updated 2022-05-14 · CVE-2016-2403

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 2.8.6 Symfony versions 3.x prior to 3.0.6

Description The issue allows remote attackers to bypass authentication by logging in with an empty password and a valid username. This is due to errors in processing user authentication data, which can be exploited by a remote attacker to bypass the authentication procedure by specifying an existing username and an empty string as the password.

Recommendations For Symfony versions prior to 2.8.6, update to version 2.8.6 or later. For Symfony versions 3.x prior to 3.0.6, update to version 3.0.6 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2019-00442

CVE-2016-2403

DSA-4262-1

GHSA-WVJ5-R78R-HHFQ

Affected Products

Symfony

References · 38

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2016-2403.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-core/CVE-2016-2403.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2016-2403.yaml · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1665 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2403 · Security Note
• https://ubuntu.com/security/CVE-2016-2403 · Vendor Advisory
• https://debian.org/security/2018/dsa-4262 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-2403 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04114 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-2403 · Security Note
• https://bdu.fstec.ru/vul/2019-04244 · Security Note
• https://cve.org/CVERecord?id=CVE-2016-2403 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11386 · Security Note
• https://osv.dev/vulnerability/DSA-4262-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-2403 · Vendor Advisory