UpHeron
All vulnerabilities

Servers and applications

CVE-2011-3389

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with…

Severity
Medium 4.3
Published
6 Sept 2011
Last changed
9 Oct 2026
Added to UpHeron
21 Oct 2026
Exploit chance
73% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
Inadequate encryption strength (CWE-326)
Attack
Over the network · No login needed
Attacker can
Read some data
CVSS vector
AV:N/AC:M/Au:N/C:P/I:N/A:N
Sources
NVD

Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

From NVD.

Affected software

SoftwareAffected versions
curlServers and applications · cpe:a:haxx:curl
  • From 7.10.6 up to 7.23.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2011-3389
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2011-3389