VulnerableCode Package Details - pkg:composer/symfony/security-core@2.8.4

Search for packages

Vulnerability	Summary	Fixed by
VCID-7gzy-b9hc-zuh2 Aliases: CVE-2021-21424 GHSA-5pv8-ppvj-4h68	Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.	3.4.48 Affected by 0 other vulnerabilities. 4.4.23 Affected by 0 other vulnerabilities. 5.2.8 Affected by 0 other vulnerabilities.
VCID-m6q9-sqw2-wffj Aliases: CVE-2018-11407 GHSA-35c5-28pg-2qg4	An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.	2.8.37 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 3.3.17 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 3.4.7 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 4.0.7 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-s59j-vhxh-47e3 Aliases: CVE-2016-2403 GHSA-wvj5-r78r-hhfq	Symfony Authentication Bypass Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.	2.8.6 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 3.0.6 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-7gzy-b9hc-zuh2
Aliases:
CVE-2021-21424
GHSA-5pv8-ppvj-4h68

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.

3.4.48
Affected by 0 other vulnerabilities.

4.4.23
Affected by 0 other vulnerabilities.

5.2.8
Affected by 0 other vulnerabilities.

VCID-m6q9-sqw2-wffj
Aliases:
CVE-2018-11407
GHSA-35c5-28pg-2qg4

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.

2.8.37
Affected by 1 other vulnerability.

3.3.17
Affected by 2 other vulnerabilities.

3.4.7
Affected by 1 other vulnerability.

4.0.7
Affected by 1 other vulnerability.

VCID-s59j-vhxh-47e3
Aliases:
CVE-2016-2403
GHSA-wvj5-r78r-hhfq

Symfony Authentication Bypass Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.

2.8.6
Affected by 2 other vulnerabilities.

3.0.6
Affected by 2 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-07-03T17:59:25.315242+00:00	GitLab Importer	Affected by	VCID-7gzy-b9hc-zuh2	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/symfony/security-core/CVE-2021-21424.yml	37.0.0
2025-07-03T17:27:14.389281+00:00	GitLab Importer	Affected by	VCID-m6q9-sqw2-wffj	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/symfony/security-core/CVE-2018-11407.yml	37.0.0
2025-07-03T17:18:25.003305+00:00	GitLab Importer	Affected by	VCID-s59j-vhxh-47e3	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/symfony/security-core/CVE-2016-2403.yml	37.0.0