‹ Back to list

CVE-2011-3189

Status: ModifiedMedium (4.3)—
Severity4.3Medium · CVSS 2.0
Exploitation probability4.21 %higher than 91% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

The crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt argument instead of the hashed string, which might allow remote attackers to bypass authentication via an arbitrary password, a different vulnerability than CVE-2011-2483.

CVSS

Base score
4.3
Version
2.0
Vector
AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
4.21 %
Percentile among all scored CVEs
91
Score date
10/22/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

PHP — PHP

CWEs

References

Show 20 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2011-3189",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-08-25T14:22:48.023",
  "references": [
    {
      "url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://osvdb.org/74726",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/45678",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://support.apple.com/kb/HT5130",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2011/08/23/4",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.php.net/ChangeLog-5.php#5.3.8",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.php.net/archive/2011.php#id2011-08-23-1",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugs.gentoo.org/show_bug.cgi?id=380261",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugs.php.net/bug.php?id=55439",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/69429",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/74726",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/45678",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.apple.com/kb/HT5130",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2011/08/23/4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.php.net/ChangeLog-5.php#5.3.8",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.php.net/archive/2011.php#id2011-08-23-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.gentoo.org/show_bug.cgi?id=380261",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.php.net/bug.php?id=55439",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/69429",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt argument instead of the hashed string, which might allow remote attackers to bypass authentication via an arbitrary password, a different vulnerability than CVE-2011-2483."
    },
    {
      "lang": "es",
      "value": "La función de cifrado en PHP v5.3.7, cuando el tipo de hash MD5 se utiliza, se devuelve el valor del argumento en vez de la cadena hash, lo que podría permitir a atacantes remotos evitar la autenticación a través de una contraseña arbitraria, una vulnerabilidad diferente a CVE-2011-2483."
    }
  ],
  "lastModified": "2026-06-16T23:32:50.030",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:php:php:5.3.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACDF768D-7F5A-4042-B7DD-398F65F3F094"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}