CVE-2016-2403
CVE-2016-2403
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
CVSS 9.8 · Critical · EPSS 4.3% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
symfony Debian:12
- Affected ranges
- ECOSYSTEM: < 2.8.6+dfsg-1
Update to 2.8.6+dfsg-1
symfony Debian:13
- Affected ranges
- ECOSYSTEM: < 2.8.6+dfsg-1
Update to 2.8.6+dfsg-1
symfony Debian:14
- Affected ranges
- ECOSYSTEM: < 2.8.6+dfsg-1
Update to 2.8.6+dfsg-1
symfony/security-core Packagist
- Versions
- v2.8.0
- v2.8.1
- v2.8.2
- v2.8.3
- v2.8.4
- v2.8.5
- Affected ranges
- ECOSYSTEM: ≥ 2.8.0, < 2.8.6
Update to 2.8.6
symfony/security-core Packagist
- Versions
- v3.0.0
- v3.0.1
- v3.0.2
- v3.0.3
- v3.0.4
- v3.0.5
- Affected ranges
- ECOSYSTEM: ≥ 3.0.0, < 3.0.6
Update to 3.0.6
symfony/security Packagist
- Versions
- v2.8.0
- v2.8.1
- v2.8.2
- v2.8.3
- v2.8.4
- v2.8.5
- Affected ranges
- ECOSYSTEM: ≥ 2.8.0, < 2.8.6
Update to 2.8.6
symfony/security Packagist
- Versions
- v3.0.0
- v3.0.1
- v3.0.2
- v3.0.3
- v3.0.4
- v3.0.5
- Affected ranges
- ECOSYSTEM: ≥ 3.0.0, < 3.0.6
Update to 3.0.6
symfony/symfony Packagist
- Versions
- v2.8.0
- v2.8.1
- v2.8.2
- v2.8.3
- v2.8.4
- v2.8.5
- Affected ranges
- ECOSYSTEM: ≥ 2.8.0, < 2.8.6
Update to 2.8.6
symfony/symfony Packagist
- Versions
- v3.0.0
- v3.0.1
- v3.0.2
- v3.0.3
- v3.0.4
- v3.0.5
- Affected ranges
- ECOSYSTEM: ≥ 3.0.0, < 3.0.6
Update to 3.0.6