Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2016-4423

Good to know:

icon

Date: June 1, 2016

The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.

Language: PHP

Severity Score

Related Resources (10)

https://github.com/symfony/symfony
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2016-4423.yaml
https://nvd.nist.gov/vuln/detail/CVE-2016-4423
https://symfony.com/cve-2016-4423
https://symfony.com/blog/cve-2016-4423-large-username-storage-in-session
https://github.com/symfony/symfony/pull/18733
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2016-4423.yaml
http://www.debian.org/security/2016/dsa-3588
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2016-4423.yaml
https://www.mend.io/vulnerability-database/CVE-2016-4423

Severity Score

Weakness Type (CWE)

Resource Management Errors

CWE-399

Top Fix

icon

Upgrade Version

Upgrade to version 2.3.41,2.7.13,2.8.6,3.0.6

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us