Symfony Authentication Bypass

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2016-2403 · ADVISORY
• FriendsOfPHP/security-advisories · WEB
• FriendsOfPHP/security-advisories · WEB
• FriendsOfPHP/security-advisories · WEB
• symfony.com/cve-2016-2403 · WEB
• web.archive.org/web/20210123224944/http://www.securityfocus.com/bid/96137 · WEB
• debian.org/security/2018/dsa-4262 · WEB
• symfony.com/blog/cve-2016-2403-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-password · WEB
• securityfocus.com/bid/96137 · Third Party Advisory

symfony/security のその他の脆弱性

• CVE-2021-21424中 5.3Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possibl…
• CVE-2020-5275高 8.1In symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule's attribu…
• CVE-2017-11365緊急 9.8Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Sy…
• CVE-2019-10911高 7.5In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an …
• CVE-2018-19790中 6.1An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.…