CVE-2016-2403

Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.

References

Affected packages

Git / github.com/symfony/security-http

Affected ranges

Type

GIT

Repo

https://github.com/symfony/security-http

Events

Introduced

a8d5dd00894f8b5e3edb897f4504c51ddc442370

Last affected

93431d2843a498bb3c1e84bae4cf8f321efd9e01

Database specific

{
    "source": "CPE_STRING",
    "cpe": [
        "cpe:2.3:a:sensiolabs:symfony:2.8.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.8.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.8.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.8.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.8.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.8.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:3.0.5:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "2.8.0"
        },
        {
            "last_affected": "2.8.0"
        },
        {
            "introduced": "2.8.1"
        },
        {
            "last_affected": "2.8.1"
        },
        {
            "introduced": "2.8.2"
        },
        {
            "last_affected": "2.8.2"
        },
        {
            "introduced": "2.8.3"
        },
        {
            "last_affected": "2.8.3"
        },
        {
            "introduced": "2.8.4"
        },
        {
            "last_affected": "2.8.4"
        },
        {
            "introduced": "2.8.5"
        },
        {
            "last_affected": "2.8.5"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.0"
        },
        {
            "introduced": "3.0.1"
        },
        {
            "last_affected": "3.0.1"
        },
        {
            "introduced": "3.0.2"
        },
        {
            "last_affected": "3.0.2"
        },
        {
            "introduced": "3.0.3"
        },
        {
            "last_affected": "3.0.3"
        },
        {
            "introduced": "3.0.4"
        },
        {
            "last_affected": "3.0.4"
        },
        {
            "introduced": "3.0.5"
        },
        {
            "last_affected": "3.0.5"
        }
    ]
}

Affected versions

2.*

2.8.0

2.8.1

2.8.2

2.8.3

2.8.4

2.8.5

3.*

3.0.0

3.0.1

3.0.2

3.0.4

3.0.5

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-2403.json"

Git / github.com/symfony/symfony