CVE-2011-1398: php Improper Input Validation
Vulnerability summary
CVE-2011-1398 is a medium (CVSS 4.3) Improper Input Validation vulnerability in php. EPSS estimates a 10.17% chance of exploitation in the next 30 days, higher than 95.6% of scored vulnerabilities. 1 public exploit is recorded.
Weaponized exploit (exploit-database, 06-10-2011)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3Timeline
- 30-08-2012PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
10.17%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
No change 0.00 pp
From 10.17% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundPHP 5.3.11/5.4.0RC2 - 'header()' HTTP Header Injection
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Php1 product
- phpEOL≤ 5.3.10 | 5.3.0 | 5.3.1 | 5.3.2 | 5.3.3 | 5.3.4 | 5.3.5 | 5.3.6 | 5.3.7 | 5.3.8 | 5.3.9
1 vendor · 1 product
References
10 links
security-tracker.debian.org/tracker/CVE-2011-1398X Refsource CONFIRM- bugs.php.net/bug.php?id=60227X Refsource MISC