Strix
26.1K

CVE-2016-4423

UnknownEPSS 1.86%

Last modified

CVE-2016-4423 is a vulnerability of currently unknown severity. The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.. EPSS estimates a 1.86% chance of exploitation in the next 30 days.

Description

The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.

Metrics

EPSS Probability
1.86%

76.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
SensiolabsSymfony<= 2.3.40
SensiolabsSymfony2.7.0
SensiolabsSymfony2.7.1
SensiolabsSymfony2.7.2
SensiolabsSymfony2.7.3
SensiolabsSymfony2.7.4
SensiolabsSymfony2.7.5
SensiolabsSymfony2.7.6
SensiolabsSymfony2.7.7
SensiolabsSymfony2.7.8
SensiolabsSymfony2.7.9
SensiolabsSymfony2.7.10
SensiolabsSymfony2.7.11
SensiolabsSymfony2.7.12
SensiolabsSymfony2.8.0
SensiolabsSymfony2.8.1
SensiolabsSymfony2.8.2
SensiolabsSymfony2.8.3
SensiolabsSymfony2.8.4
SensiolabsSymfony2.8.5
SensiolabsSymfony3.0.0
SensiolabsSymfony3.0.1
SensiolabsSymfony3.0.2
SensiolabsSymfony3.0.3
SensiolabsSymfony3.0.4
SensiolabsSymfony3.0.5
DebianDebian Linux8.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2016-4423?
The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.
How severe is CVE-2016-4423?
Severity scoring for CVE-2016-4423 is pending analysis. The EPSS model estimates a 1.86% probability of exploitation in the next 30 days.
How do I fix CVE-2016-4423?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2016-4423?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST