Fluid Attacks Database

Description

Symfony Authentication Bypass Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
packagist	symfony/security	>=2.8.0 <2.8.6 \|\| >=3.0.0 <3.0.6	2.8.6, 3.0.6
packagist	symfony/symfony	>=2.8.0 <2.8.6 \|\| >=3.0.0 <3.0.6	2.8.6, 3.0.6
packagist	symfony/security-core	>=2.8.0 <2.8.6 \|\| >=3.0.0 <3.0.6	2.8.6, 3.0.6
debian 13	symfony	>=0 <2.8.6+dfsg-1	2.8.6+dfsg-1
debian 12	symfony	>=0 <2.8.6+dfsg-1	2.8.6+dfsg-1
debian 11	symfony	>=0 <2.8.6+dfsg-1	2.8.6+dfsg-1
debian 14	symfony	>=0 <2.8.6+dfsg-1	2.8.6+dfsg-1

Aliases

1. CVE-2016-24032. NVD-2016-24033. OSV-2016-24034. OSV-DEBIAN-2016-24035. GCVE-2016-24036. SECURITY-TRACKER-CVE-2016-2403

References

1. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-core/CVE-2016-2403.yaml2. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2016-2403.yaml3. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2016-2403.yaml4. https://symfony.com/cve-2016-24035. https://web.archive.org/web/20210123224944/http://www.securityfocus.com/bid/961376. https://www.debian.org/security/2018/dsa-42627. http://symfony.com/blog/cve-2016-2403-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-password