NVD

Id
20082  
Name
CVE-2016-4423  
Description
The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-19  
Published
2016-06-01  
Modified Date
2016-06-03  
Seq
2016-4423  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
109521 20082 CVE-2016-4423 DSA-3588  View
109522 20082 CVE-2016-4423 https://github.com/symfony/symfony/pull/18733  View
109523 20082 CVE-2016-4423 https://symfony.com/blog/cve-2016-4423-large-username-storage-in-session  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
2220 JVNDB-2016-002993 Symfony の Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php におけるサービス運用妨害 (DoS) の脆弱性 Symfony の Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php の attemptAuthentication 関数は、セッションに保存されるユーザ名の長さを制限しないため、サービス運用妨害 (セッションストレージの消費) 状態にされる脆弱性が存在します。 CVE-2016-4423 90929 CVE-2016-4423 20082 5 7.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-002993.html 2016-05-09 2016-06-06 View