CVE-2018-11407

2018-06-1316:29:01

Google

osv.dev

10 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

79.0%

JSON

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a “null” password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.

CPENameOperatorVersion
security-httpeq3.3.0
security-httpeq3.3.6
security-httpeq3.4.5
security-httpeq3.3.4
security-httpeq2.7.35
security-httpeq2.7.29
security-httpeq2.7.28
security-httpeq3.4.0-BETA4
security-httpeq3.3.8
security-httpeq2.8.27

Name	Operator	Version
security-http	eq	3.3.0
security-http	eq	3.3.6
security-http	eq	3.4.5
security-http	eq	3.3.4
security-http	eq	2.7.35
security-http	eq	2.7.29
security-http	eq	2.7.28
security-http	eq	3.4.0-BETA4
security-http	eq	3.3.8
security-http	eq	2.8.27