CVE-2016-2403

Published: Feb 7, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.

Affected (12)

Products: Sensiolabs: Symfony

Sensiolabs

1 product

Symfony

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Sensiolabs Symfony	Version 2.8.0
Sensiolabs Symfony	Version 2.8.1
Sensiolabs Symfony	Version 2.8.2
Sensiolabs Symfony	Version 2.8.3
Sensiolabs Symfony	Version 2.8.4
Sensiolabs Symfony	Version 2.8.5
Sensiolabs Symfony	Version 3.0.0
Sensiolabs Symfony	Version 3.0.1
Sensiolabs Symfony	Version 3.0.2
Sensiolabs Symfony	Version 3.0.3
Sensiolabs Symfony	Version 3.0.4
Sensiolabs Symfony	Version 3.0.5