Skip to content
OpenAdvisories
Critical USN-4836-1 1 CVE

symfony vulnerability

Published Mar 15, 2021 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Symfony through the HttpFoundation
component allowed unauthorized access on a misconfigured LDAP server. A
remote attacker could use this vulnerability to gain unauthorized access.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS symfony 3.4.6+dfsg-1ubuntu0.1+esm1

Vulnerabilities 1

  • Critical 9.8
    CVE-2018-11407

    Symfony Authentication Bypass

    An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which t…

    symfony/symfony symfony symfony symfony/security Debian Ubuntu Packagist

References

  • report
    https://ubuntu.com/security/CVE-2018-11407