VULNERABILITY INTELLIGENCE
CVE-2016-2403
CVSS score9.8 CRITICAL
EPSS probability2.93%
CISA KEVNot currently listed
Published2017-02-07
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
Weakness classification
- CWE-287: Improper Authentication
Primary references
- cve@mitre.org — Vendor Advisory
- cve@mitre.org — Third Party Advisory, VDB Entry
- cve@mitre.org
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108