CVE-2018-11407
First published: Fri May 25 2018(Updated: )
An issue was discovered in the LDAP component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. **NOTE:** this issue exists because of an incomplete fix for CVE-2016-2403.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/symfony/security | >=2.8.0<2.8.37>=3.0.0<3.1.0>=3.1.0<3.2.0>=3.2.0<3.3.0>=3.3.0<3.3.17>=3.4.0<3.4.7>=4.0.0<4.0.7 | |
| composer/symfony/security-core | >=2.8.0<2.8.37>=3.0.0<3.1.0>=3.1.0<3.2.0>=3.2.0<3.3.0>=3.3.0<3.3.17>=3.4.0<3.4.7>=4.0.0<4.0.7 | |
| composer/symfony/symfony | >=2.8.0<2.8.37>=3.0.0<3.1.0>=3.1.0<3.2.0>=3.2.0<3.3.0>=3.3.0<3.3.17>=3.4.0<3.4.7>=4.0.0<4.0.7 | |
| SensioLabs Symfony | >=2.8.0<2.8.37 | |
| SensioLabs Symfony | >=3.3.0<3.3.17 | |
| SensioLabs Symfony | >=3.4.0<3.4.7 | |
| SensioLabs Symfony | >=4.0.0<4.0.7 | |
| composer/symfony/symfony | >=4.0.0<4.0.7 | 4.0.7 |
| composer/symfony/symfony | >=3.4.0<3.4.7 | 3.4.7 |
| composer/symfony/symfony | >=3.0.0<3.3.17 | 3.3.17 |
| composer/symfony/symfony | >=2.8.0<2.8.37 | 2.8.37 |
| composer/symfony/security | >=4.0.0<4.0.7 | 4.0.7 |
| composer/symfony/security | >=3.4.0<3.4.7 | 3.4.7 |
| composer/symfony/security | >=3.0.0<3.3.17 | 3.3.17 |
| composer/symfony/security | >=2.8.0<2.8.37 | 2.8.37 |
| composer/symfony/security-core | >=4.0.0<4.0.7 | 4.0.7 |
| composer/symfony/security-core | >=3.4.0<3.4.7 | 3.4.7 |
| composer/symfony/security-core | >=3.0.0<3.3.17 | 3.3.17 |
| composer/symfony/security-core | >=2.8.0<2.8.37 | 2.8.37 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://symfony.com/cve-2018-11407
- https://symfony.com/blog/cve-2018-11407-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-password
- https://nvd.nist.gov/vuln/detail/CVE-2018-11407
- https://github.com/symfony/symfony/pull/27377
- https://github.com/symfony/symfony/commit/b46fc93785d37ffa5d706a82cd175b33ce8f2934
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-core/CVE-2018-11407.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2018-11407.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11407.yaml
- https://github.com/advisories/GHSA-35c5-28pg-2qg4 (Advisory)
Frequently Asked Questions
What is CVE-2018-11407?
CVE-2018-11407 is a vulnerability in the Ldap component in Symfony that allows unauthorized access on a misconfigured LDAP server when using an empty password.
What is the severity level of CVE-2018-11407?
The Severity level of CVE-2018-11407 is critical with a score of 9.8 out of 10.
Which software versions are affected by CVE-2018-11407?
CVE-2018-11407 affects Symfony versions 2.8.x, 3.3.x, 3.4.x, and 4.0.x.
How can unauthorized access be bypassed in CVE-2018-11407?
Unauthorized access can be bypassed in CVE-2018-11407 by logging in with a "null" password and valid username, which triggers an unauthenticated bind.
Where can I find more information about CVE-2018-11407?
You can find more information about CVE-2018-11407 on the Symfony website.
- collector/friends-of-php
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-35c5-28pg-2qg4
- alias/CVE-2018-11407
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/softwarecombine
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- package-manager/composer
- vendor/sensiolabs
- canonical/sensiolabs symfony
- version/sensiolabs symfony/2.8.0
- version/sensiolabs symfony/3.3.0
- version/sensiolabs symfony/3.4.0
- version/sensiolabs symfony/4.0.0