CVE Catalog
CVE-2016-2403
CriticalSummary
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
Risk Assessment
Attackers can gain access to the system without providing a password, posing a serious threat to the security of the organization's data and resources.
Recommendation
It is recommended to upgrade Symfony to version 2.8.6 or 3.0.6 and higher to protect the system against this type of attack.
Original NVD description (English source)
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.