Every CVE Search/ Get API key

CVE-2018-11407

Symfony Authentication Bypass

9.8 CriticalFix available

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.37%Up 1.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.

Record
CVE-2018-11407
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-287
Updated
2026-11-02
CVE List No score

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.

Record
CVE-2018-11407
Updated
2026-11-02
EUVDEUVD-2022-2111 No score

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.

Record
EUVD-2022-2111
Updated
2026-11-03
GitHub AdvisoriesGHSA-35c5-28pg-2qg4 9.8

Symfony Authentication Bypass

An issue was discovered in the LDAP component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.

Record
GHSA-35c5-28pg-2qg4
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
OSV 9.8

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.

Record
CVE-2018-11407
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-11407 9.8

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.

Record
DEBIAN-CVE-2018-11407
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-35c5-28pg-2qg4 9.8

Symfony Authentication Bypass

An issue was discovered in the LDAP component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.

Record
GHSA-35c5-28pg-2qg4
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
OSVUBUNTU-CVE-2018-11407 9.8

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.

Record
UBUNTU-CVE-2018-11407
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUSN-4836-1 No score

symfony vulnerability

It was discovered that Symfony through the HttpFoundation component allowed unauthorized access on a misconfigured LDAP server. A remote attacker could use this vulnerability to gain unauthorized access.

Record
USN-4836-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
symfony/security-core
Packagist
 2.8.0 up to 2.8.37
2.8.37
symfony/security-core
Packagist
 3.0.0 up to 3.3.17
3.3.17
symfony/security-core
Packagist
 3.4.0 up to 3.4.7
3.4.7
symfony/security-core
Packagist
 4.0.0 up to 4.0.7
4.0.7
symfony/security
Packagist
 2.8.0 up to 2.8.37
2.8.37
symfony/security
Packagist
 3.0.0 up to 3.3.17
3.3.17
symfony/security
Packagist
 3.4.0 up to 3.4.7
3.4.7
symfony/security
Packagist
 4.0.0 up to 4.0.7
4.0.7
symfony/symfony
Packagist
 2.8.0 up to 2.8.37
2.8.37
symfony/symfony
Packagist
 3.0.0 up to 3.3.17
3.3.17
Show 18 moreShow less
Affected packages
PackageAffectedFixed
symfony/symfony
Packagist
 3.4.0 up to 3.4.7
3.4.7
symfony/symfony
Packagist
 4.0.0 up to 4.0.7
4.0.7
symfony
Debian:12
 before 3.4.12+dfsg-1
3.4.12+dfsg-1
symfony
Debian:13
 before 3.4.12+dfsg-1
3.4.12+dfsg-1
symfony
Debian:14
 before 3.4.12+dfsg-1
3.4.12+dfsg-1
symfony/security-core
Packagist
 2.8.0 up to 2.8.37, plus listed versions
v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12
Show 32 moreShow less
v2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.4v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9
2.8.37
symfony/security-core
Packagist
 3.0.0 up to 3.3.17, plus listed versions
v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4
Show 45 moreShow less
v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14
3.3.17
symfony/security-core
Packagist
 3.4.0 up to 3.4.7, plus listed versions
v3.4.0v3.4.1v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6
3.4.7
symfony/security-core
Packagist
 4.0.0 up to 4.0.7, plus listed versions
v4.0.0v4.0.1v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6
4.0.7
symfony/security
Packagist
 2.8.0 up to 2.8.37, plus listed versions
v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12
Show 32 moreShow less
v2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.4v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9
2.8.37
symfony/security
Packagist
 3.0.0 up to 3.3.17, plus listed versions
v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4
Show 45 moreShow less
v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14
3.3.17
symfony/security
Packagist
 3.4.0 up to 3.4.7, plus listed versions
v3.4.0v3.4.1v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6
3.4.7
symfony/security
Packagist
 4.0.0 up to 4.0.7, plus listed versions
v4.0.0v4.0.1v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6
4.0.7
symfony/symfony
Packagist
 2.8.0 up to 2.8.37, plus listed versions
v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12
Show 32 moreShow less
v2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.4v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9
2.8.37
symfony/symfony
Packagist
 3.0.0 up to 3.3.17, plus listed versions
v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4
Show 45 moreShow less
v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14
3.3.17
symfony/symfony
Packagist
 3.4.0 up to 3.4.7, plus listed versions
v3.4.0v3.4.1v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6
3.4.7
symfony/symfony
Packagist
 4.0.0 up to 4.0.7, plus listed versions
v4.0.0v4.0.1v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6
4.0.7
symfony
Ubuntu:Pro:18.04:LTS
 before 3.4.6+dfsg-1ubuntu0.1+esm1, plus listed versions
2.8.7+dfsg-1.3ubuntu13.4.3+dfsg-1ubuntu43.4.6+dfsg-13.4.6+dfsg-1ubuntu0.1
3.4.6+dfsg-1ubuntu0.1+esm1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-11407 is a critical vulnerability (CVSS 9.8) in Sensiolabs Symfony, published June 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.37%, the 83rd percentile. Fixed in symfony/security-core 2.8.37.

References

Show 8 moreShow less
This page doesn't list everything

Left out here: 30 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open