« Volver al listado

CVE-2016-2403

Estado: ModificadaCrítica (9.8)—

Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sensiolabs — Symfony

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-2403",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-02-07T17:59:00.303",
  "references": [
    {
      "url": "http://symfony.com/blog/cve-2016-2403-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-password",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/96137",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.debian.org/security/2018/dsa-4262",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://symfony.com/blog/cve-2016-2403-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-password",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/96137",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.debian.org/security/2018/dsa-4262",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind."
    },
    {
      "lang": "es",
      "value": "Symfony en versiones anteriores a 2.8.6 y 3.x en versiones anteriores a 3.0.6 permite a atacantes remotos eludir la autenticación mediante el inicio de sesión con un nombre de usuario válido y una contraseña vacía, lo que desencadena una unión no autenticada."
    }
  ],
  "lastModified": "2026-06-17T00:44:00.303",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:2.8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C01C2E25-6FEE-49C8-A9D8-F4935A0F915E"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:2.8.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68869331-57A0-451D-9888-32643537B736"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:2.8.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3598D2C0-4AB1-4C4F-98ED-2862E7C42497"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:2.8.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F100F2F-EB9F-41E3-AB84-49E49A61C728"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:2.8.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "135156B2-2ADF-4127-A4F1-309FB99868B8"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:2.8.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AABE15FF-B488-49D6-B284-89ECE1C2E54C"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:3.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D07C355A-FF00-44DF-A899-B727DAEBB83F"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:3.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "235F1F79-E3FB-452C-98E3-A3D978CC9819"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:3.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC270EEB-02CC-4960-9F3D-41AB86636864"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:3.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1570191-3967-4C89-B7B3-07C4FC369C95"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:3.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1FC56E52-31DB-4B3C-8E07-B7358079DEC9"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:3.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE067114-08AF-46F0-8F46-1485C93A8857"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}