CVEvulnerability
CVE-2011-3189
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2011-08-25
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-310
Description
The crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt argument instead of the hashed string, which might allow remote attackers to bypass authentication via an arbitrary password, a different vulnerability than CVE-2011-2483.
Affected configurations
• php php 5.3.7
Related
Weakness · not in database (1)
References
- http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html lists.apple.com
- http://osvdb.org/74726 osvdb.org
- http://secunia.com/advisories/45678 Vendor Advisory
- http://support.apple.com/kb/HT5130 support.apple.com
- http://www.openwall.com/lists/oss-security/2011/08/23/4 www.openwall.com
- http://www.php.net/ChangeLog-5.php#5.3.8 www.php.net
- http://www.php.net/archive/2011.php#id2011-08-23-1 www.php.net
- https://bugs.gentoo.org/show_bug.cgi?id=380261 bugs.gentoo.org
- https://bugs.php.net/bug.php?id=55439 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69429 exchange.xforce.ibmcloud.com
- http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html lists.apple.com
- http://osvdb.org/74726 osvdb.org
- http://secunia.com/advisories/45678 Vendor Advisory
- http://support.apple.com/kb/HT5130 support.apple.com
- http://www.openwall.com/lists/oss-security/2011/08/23/4 www.openwall.com
- http://www.php.net/ChangeLog-5.php#5.3.8 www.php.net
- http://www.php.net/archive/2011.php#id2011-08-23-1 www.php.net
- https://bugs.gentoo.org/show_bug.cgi?id=380261 bugs.gentoo.org
- https://bugs.php.net/bug.php?id=55439 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69429 exchange.xforce.ibmcloud.com