| Package | Affected versions | Patched versions |
|---|---|---|
| symfony/security | ≥ 2.8.0, < 2.8.6≥ 3.0.0, < 3.0.6 | 2.8.63.0.6 |
| symfony/security-core | ≥ 2.8.0, < 2.8.6≥ 3.0.0, < 3.0.6 | 2.8.63.0.6 |
| symfony/symfony | ≥ 2.8.0, < 2.8.6≥ 3.0.0, < 3.0.6 | 2.8.63.0.6 |
| symfony | = 2.8.0= 2.8.1= 2.8.2= 2.8.3= 2.8.4= 2.8.5= 3.0.0= 3.0.1= 3.0.2= 3.0.3= 3.0.4= 3.0.5 |
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free