CVE-2013-5750

Published: Sep 25, 2013Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The login form in the FriendsOfSymfony FOSUserBundle bundle before 1.3.3 for Symfony allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation.

Affected (10)

Products: Friends Of Symfony Project: Fosuserbundle

Friends Of Symfony Project

1 product

Fosuserbundle

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Friends Of Symfony Project Fosuserbundle	version ≤ 1.3.2
Friends Of Symfony Project Fosuserbundle	Version 1.0.0
Friends Of Symfony Project Fosuserbundle	Version 1.1.0
Friends Of Symfony Project Fosuserbundle	Version 1.2.0
Friends Of Symfony Project Fosuserbundle	Version 1.2.1
Friends Of Symfony Project Fosuserbundle	Version 1.2.3
Friends Of Symfony Project Fosuserbundle	Version 1.2.4
Friends Of Symfony Project Fosuserbundle	Version 1.2.5
Friends Of Symfony Project Fosuserbundle	Version 1.3.0
Friends Of Symfony Project Fosuserbundle	Version 1.3.1

Related CWEs

CWE-399

References (2)

http://symfony.com/blog/cve-2013-5750-security-issue-in-fosuserbundle-login-form

Source: cve@mitre.org

PatchVendor Advisory

http://symfony.com/blog/cve-2013-5750-security-issue-in-fosuserbundle-login-form

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.