« Back to list

CVE-2016-2403

Status: ModifiedCritical (9.8)—

Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Sensiolabs — Symfony

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2016-2403",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-02-07T17:59:00.303",
  "references": [
    {
      "url": "http://symfony.com/blog/cve-2016-2403-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-password",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/96137",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.debian.org/security/2018/dsa-4262",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://symfony.com/blog/cve-2016-2403-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-password",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/96137",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.debian.org/security/2018/dsa-4262",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind."
    },
    {
      "lang": "es",
      "value": "Symfony en versiones anteriores a 2.8.6 y 3.x en versiones anteriores a 3.0.6 permite a atacantes remotos eludir la autenticación mediante el inicio de sesión con un nombre de usuario válido y una contraseña vacía, lo que desencadena una unión no autenticada."
    }
  ],
  "lastModified": "2026-06-17T00:44:00.303",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:2.8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C01C2E25-6FEE-49C8-A9D8-F4935A0F915E"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:2.8.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68869331-57A0-451D-9888-32643537B736"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:2.8.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3598D2C0-4AB1-4C4F-98ED-2862E7C42497"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:2.8.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F100F2F-EB9F-41E3-AB84-49E49A61C728"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:2.8.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "135156B2-2ADF-4127-A4F1-309FB99868B8"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:2.8.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AABE15FF-B488-49D6-B284-89ECE1C2E54C"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:3.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D07C355A-FF00-44DF-A899-B727DAEBB83F"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:3.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "235F1F79-E3FB-452C-98E3-A3D978CC9819"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:3.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC270EEB-02CC-4960-9F3D-41AB86636864"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:3.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1570191-3967-4C89-B7B3-07C4FC369C95"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:3.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1FC56E52-31DB-4B3C-8E07-B7358079DEC9"
            },
            {
              "criteria": "cpe:2.3:a:sensiolabs:symfony:3.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE067114-08AF-46F0-8F46-1485C93A8857"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}