Access Restriction Bypass Affecting symfony/symfony package, versions >=3.0.0, <3.0.6 >=2.8.0, <2.8.6
Snyk CVSS
Attack Complexity
Low
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
EPSS
0.58% (78th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-SYMFONYSYMFONY-70221
- published 9 May 2016
- disclosed 9 May 2016
- credit Matteo Rossi
Introduced: 9 May 2016
CVE-2016-2403 Open this link in a new tabHow to fix?
Upgrade symfony/symfony to version 3.0.6, 2.8.6 or higher.
Overview
Affected versions of symfony/symfony are vulnerable to Access Restriction Bypass.
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.