CVE-2016-2403 Symfony Authentication Bypass
CriticalCVSS 9.8
EPSS 4.3%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| symfony/security-core(Packagist) | >= 2.8.0, < 2.8.6 | 2.8.6 |
| symfony/security-core(Packagist) | = v2.8.0 | No fix listed |
| symfony/security-core(Packagist) | = v2.8.1 | No fix listed |
| symfony/security-core(Packagist) | = v2.8.2 | No fix listed |
| symfony/security-core(Packagist) | = v2.8.3 | No fix listed |
| symfony/security-core(Packagist) | = v2.8.4 | No fix listed |
| symfony/security-core(Packagist) | = v2.8.5 | No fix listed |
| symfony/security-core(Packagist) | >= 3.0.0, < 3.0.6 | 3.0.6 |
| symfony/security-core(Packagist) | = v3.0.0 | No fix listed |
| symfony/security-core(Packagist) | = v3.0.1 | No fix listed |
| symfony/security-core(Packagist) | = v3.0.2 | No fix listed |
| symfony/security-core(Packagist) | = v3.0.3 | No fix listed |
| symfony/security-core(Packagist) | = v3.0.4 | No fix listed |
| symfony/security-core(Packagist) | = v3.0.5 | No fix listed |
| symfony/security(Packagist) | >= 2.8.0, < 2.8.6 | 2.8.6 |
| symfony/security(Packagist) | = v2.8.0 | No fix listed |
| symfony/security(Packagist) | = v2.8.1 | No fix listed |
| symfony/security(Packagist) | = v2.8.2 | No fix listed |
| symfony/security(Packagist) | = v2.8.3 | No fix listed |
| symfony/security(Packagist) | = v2.8.4 | No fix listed |
| symfony/security(Packagist) | = v2.8.5 | No fix listed |
| symfony/security(Packagist) | >= 3.0.0, < 3.0.6 | 3.0.6 |
| symfony/security(Packagist) | = v3.0.0 | No fix listed |
| symfony/security(Packagist) | = v3.0.1 | No fix listed |
| symfony/security(Packagist) | = v3.0.2 | No fix listed |
Show 32 more
| Product | Affected versions | Fixed in |
|---|---|---|
| symfony/security(Packagist) | = v3.0.3 | No fix listed |
| symfony/security(Packagist) | = v3.0.4 | No fix listed |
| symfony/security(Packagist) | = v3.0.5 | No fix listed |
| symfony/symfony(Packagist) | >= 2.8.0, < 2.8.6 | 2.8.6 |
| symfony/symfony(Packagist) | = v2.8.0 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.1 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.2 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.3 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.4 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.5 | No fix listed |
| symfony/symfony(Packagist) | >= 3.0.0, < 3.0.6 | 3.0.6 |
| symfony/symfony(Packagist) | = v3.0.0 | No fix listed |
| symfony/symfony(Packagist) | = v3.0.1 | No fix listed |
| symfony/symfony(Packagist) | = v3.0.2 | No fix listed |
| symfony/symfony(Packagist) | = v3.0.3 | No fix listed |
| symfony/symfony(Packagist) | = v3.0.4 | No fix listed |
| symfony/symfony(Packagist) | = v3.0.5 | No fix listed |
| debian/symfony(Debian:12) | < 2.8.6+dfsg-1 | 2.8.6+dfsg-1 |
| debian/symfony(Debian:13) | < 2.8.6+dfsg-1 | 2.8.6+dfsg-1 |
| debian/symfony(Debian:14) | < 2.8.6+dfsg-1 | 2.8.6+dfsg-1 |
| sensiolabs symfony | = 2.8.0 | No fix listed |
| sensiolabs symfony | = 2.8.1 | No fix listed |
| sensiolabs symfony | = 2.8.2 | No fix listed |
| sensiolabs symfony | = 2.8.3 | No fix listed |
| sensiolabs symfony | = 2.8.4 | No fix listed |
| sensiolabs symfony | = 2.8.5 | No fix listed |
| sensiolabs symfony | = 3.0.0 | No fix listed |
| sensiolabs symfony | = 3.0.1 | No fix listed |
| sensiolabs symfony | = 3.0.2 | No fix listed |
| sensiolabs symfony | = 3.0.3 | No fix listed |
| sensiolabs symfony | = 3.0.4 | No fix listed |
| sensiolabs symfony | = 3.0.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit
- github.com exploit
- github.com exploit
- symfony.com
- web.archive.org
- DSA-4262 vendor-advisory
- symfony.com vendor-advisory
- github.com
- Debian Security Tracker CVE-2016-2403 vendor-advisory
- 96137 third-party-advisory vdb-entry