CVE-2011-3189
Last modified
CVE-2011-3189 is a vulnerability of currently unknown severity. The crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt argument instead of the hashed string, which might allow remote attackers to bypass authentication via an arbitrary password, a different vulnerability than CVE-2011-2483.. EPSS estimates a 4.21% chance of exploitation in the next 30 days.
Description
The crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt argument instead of the hashed string, which might allow remote attackers to bypass authentication via an arbitrary password, a different vulnerability than CVE-2011-2483.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | 5.3.7 |
References
- http://secunia.com/advisories/45678Vendor Advisory
- http://secunia.com/advisories/45678Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2011-3189?
How severe is CVE-2011-3189?
How do I fix CVE-2011-3189?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2011
- CVE-2011-3183A Cross-Site Scripting (XSS) vulnerability exists in the rcI…6.1
- CVE-2011-3184The msn_httpconn_parse_data function in httpconn.c in the MS…
- CVE-2011-3185gtkutils.c in Pidgin before 2.10.0 on Windows allows user-as…
- CVE-2011-3186CRLF injection vulnerability in actionpack/lib/action_contro…
- CVE-2011-3187The to_s method in actionpack/lib/action_dispatch/middleware…
- CVE-2011-3188The (1) IPv4 and (2) IPv6 implementations in the Linux kerne…9.1
- CVE-2011-3190Certain AJP protocol connector implementations in Apache Tom…
- CVE-2011-3191Integer signedness error in the CIFSFindNext function in fs/…8.8
- CVE-2011-3192The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x …
- CVE-2011-3193Heap-based buffer overflow in the Lookup_MarkMarkPos functio…
- CVE-2011-3194Buffer overflow in the TIFF reader in gui/image/qtiffhandler…
- CVE-2011-3195shared/inc/sql/lists.php in Domain Technologie Control (DTC)…
Are you affected by CVE-2011-3189?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST