CVE-2017-11365: Improper Access Control (CWE-284)
value: Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 9.8
Published: 2019-05-23T18:29Z
Repository: https://github.com/symfony/symfony
Language: PHP
Files changed: src/Symfony/Component/Security/Core/Tests/Validator/Constraints/UserPasswordValidatorTest.php, src/Symfony/Component/Security/Core/Validator/Constraints/UserPasswordValidator.php
Commit date: 2017-07-14 16:25:02 +0200
Commit message: [Security] validate empty passwords again

Diff: diff --git a/src/Symfony/Component/Security/Core/Tests/Validator/Constraints/UserPasswordValidatorTest.php b/src/Symfony/Component/Security/Core/Tests/Validator/Constraints/UserPasswordValidatorTest.php
index 7ebe65c647..942a4a6350 100644
--- a/src/Symfony/Component/Security/Core/Tests/Validator/Constraints/UserPasswordValidatorTest.php
+++ b/src/Symfony/Component/Security/Core/Tests/Validator/Constraints/UserPasswordValidatorTest.php
@@ -88,10 +88,33 @@ abstract class UserPasswordValidatorTest extends AbstractConstraintValidatorTest
 
         $this->buildViolation('myMessage')
             ->assertRaised();
     }
 
+    /**
+     * @dataProvider emptyPasswordData
+     */
+    public function testEmptyPasswordsAreNotValid($password)
+    {
+        $constraint = new UserPassword(array(
+            'message' => 'myMessage',
+        ));
+
+        $this->validator->validate($password, $constraint);
+
+        $this->buildViolation('myMessage')
+            ->assertRaised();
+    }
+
+    public function emptyPasswordData()
+    {
+        return array(
+            array(null),
+            array(''),
+        );
+    }
+
     /**
      * @expectedException \Symfony\Component\Validator\Exception\ConstraintDefinitionException
      */
     public function testUserIsNotValid()
     {
diff --git a/src/Symfony/Component/Security/Core/Validator/Constraints/UserPasswordValidator.php b/src/Symfony/Component/Security/Core/Validator/Constraints/UserPasswordValidator.php
index 5f4c146cab..c2ab13b2f6 100644
--- a/src/Symfony/Component/Security/Core/Validator/Constraints/UserPasswordValidator.php
+++ b/src/Symfony/Component/Security/Core/Validator/Constraints/UserPasswordValidator.php
@@ -38,10 +38,12 @@ class UserPasswordValidator extends ConstraintValidator
         if (!$constraint instanceof UserPassword) {
             throw new UnexpectedTypeException($constraint, __NAMESPACE__.'\UserPassword');
         }
 
         if (null === $password || '' === $password) {
+            $this->context->addViolation($constraint->message);
+
             return;
         }
 
         $user = $this->tokenStorage->getToken()->getUser();
 

Fixed code:     /**
     * @dataProvider emptyPasswordData
     */
    public function testEmptyPasswordsAreNotValid($password)
    {
        $constraint = new UserPassword(array(
            'message' => 'myMessage',
        ));

        $this->validator->validate($password, $constraint);

        $this->buildViolation('myMessage')
            ->assertRaised();
    }

    public function emptyPasswordData()
    {
        return array(
            array(null),
            array(''),
        );
    }

            $this->context->addViolation($constraint->message);