{"id":"CVE-2017-11365","details":"Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator.","aliases":["GHSA-q87v-q8fw-gmj5"],"modified":"2026-08-07T14:48:40.883765Z","published":"2019-05-23T18:29:00.373Z","references":[{"type":"FIX","url":"https://github.com/symfony/symfony/commit/878198cefae028386c6dc800ccbf18f2b9cbff3f"},{"type":"FIX","url":"https://github.com/symfony/symfony/pull/23507"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/symfony/security-http","events":[{"introduced":"459e2569cf47660bed0efba1d451803fe1061c55"},{"last_affected":"b5684f5041e79d7e661c2afc046390fc7666f428"}],"database_specific":{"cpe":["cpe:2.3:a:sensiolabs:symfony:2.7.30:*:*:*:*:*:*:*","cpe:2.3:a:sensiolabs:symfony:2.8.23:*:*:*:*:*:*:*","cpe:2.3:a:sensiolabs:symfony:3.2.10:*:*:*:*:*:*:*","cpe:2.3:a:sensiolabs:symfony:3.3.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.7.30"},{"last_affected":"2.7.30"},{"introduced":"2.8.23"},{"last_affected":"2.8.23"},{"introduced":"3.2.10"},{"last_affected":"3.2.10"},{"introduced":"3.3.3"},{"last_affected":"3.3.3"}],"source":"CPE_STRING"}}],"versions":["2.7.30","2.8.23","3.2.10","3.3.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-11365.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/symfony/symfony","events":[{"introduced":"90fa8a8b1a8a7a6e84e56ba50471f74f02f7be6e"},{"last_affected":"098bb166d51cdf0b0541550d037bb3ad1f8fa846"},{"fixed":"878198cefae028386c6dc800ccbf18f2b9cbff3f"}],"database_specific":{"cpe":["cpe:2.3:a:sensiolabs:symfony:2.7.30:*:*:*:*:*:*:*","cpe:2.3:a:sensiolabs:symfony:2.8.23:*:*:*:*:*:*:*","cpe:2.3:a:sensiolabs:symfony:3.2.10:*:*:*:*:*:*:*","cpe:2.3:a:sensiolabs:symfony:3.3.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.7.30"},{"last_affected":"2.7.30"},{"introduced":"2.8.23"},{"last_affected":"2.8.23"},{"introduced":"3.2.10"},{"last_affected":"3.2.10"},{"introduced":"3.3.3"},{"last_affected":"3.3.3"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["2.7.30","2.8.23","3.2.10","3.3.3","v2.7.31","v2.7.30"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-11365.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}