CVE-2011-0633

The Net::HTTPS module in libwww-perl (LWP) before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof servers via man-in-the-middle (MITM) attacks involving hostnames that are not properly validated. NOTE: it could be argued that this is a design limitation of the Net::HTTPS API, and separate implementations should be independently assigned CVE identifiers for not working around this limitation. However, because this API was modified within LWP, a single CVE identifier has been assigned.

Published: 2011-05-13 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2011-0633 is rated Moderate Risk (52.7/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 4.25%). EPSS rose +4.11% over the last day, indicating growing attacker interest. Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2011-0633

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.14% 4.25% +4.11%
2 2025-03-30 0.27% 0.14% -0.13%
3 2025-03-29 — 0.27% —

Full EPSS history (6 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2011-0633

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
4.3 2.0 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:N)
No availability impact.
 8.6 2.9 [email protected]

Weakness enumeration for CVE-2011-0633

OS Trackers for CVE-2011-0633

vendor priority summary link
debian low CVE-2011-0633 low priority: Debian including 1 source packages (libwww-perl), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2011-0633
gentoo normal CVE-2011-0633: 1 GLSA(s) (201402-04), 1 atom(s) (dev-perl/libwww-perl); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2011-0633
redhat medium — https://access.redhat.com/security/cve/CVE-2011-0633
ubuntu medium CVE-2011-0633 medium priority: Ubuntu including 1 source packages (libwww-perl), 7 status rows across 7 suites (dapper, hardy, lucid, maverick, natty, oneiric, upstream): ignored 5, not-affected 1, released 1. https://ubuntu.com/security/CVE-2011-0633

Affected software / configurations for CVE-2011-0633

Vendor Product Version Raw CPE
gisle_aas libwww-perl 0.01 cpe:2.3:a:gisle_aas:libwww-perl:0.01:*:*:*:*:*:*:*
gisle_aas libwww-perl 0.02 cpe:2.3:a:gisle_aas:libwww-perl:0.02:*:*:*:*:*:*:*
gisle_aas libwww-perl 0.03 cpe:2.3:a:gisle_aas:libwww-perl:0.03:*:*:*:*:*:*:*
gisle_aas libwww-perl 0.04 cpe:2.3:a:gisle_aas:libwww-perl:0.04:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.00 cpe:2.3:a:gisle_aas:libwww-perl:5.00:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.01 cpe:2.3:a:gisle_aas:libwww-perl:5.01:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.02 cpe:2.3:a:gisle_aas:libwww-perl:5.02:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.03 cpe:2.3:a:gisle_aas:libwww-perl:5.03:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.04 cpe:2.3:a:gisle_aas:libwww-perl:5.04:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.05 cpe:2.3:a:gisle_aas:libwww-perl:5.05:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.06 cpe:2.3:a:gisle_aas:libwww-perl:5.06:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.07 cpe:2.3:a:gisle_aas:libwww-perl:5.07:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.08 cpe:2.3:a:gisle_aas:libwww-perl:5.08:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.09 cpe:2.3:a:gisle_aas:libwww-perl:5.09:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.10 cpe:2.3:a:gisle_aas:libwww-perl:5.10:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.11 cpe:2.3:a:gisle_aas:libwww-perl:5.11:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.12 cpe:2.3:a:gisle_aas:libwww-perl:5.12:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.13 cpe:2.3:a:gisle_aas:libwww-perl:5.13:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.14 cpe:2.3:a:gisle_aas:libwww-perl:5.14:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.15 cpe:2.3:a:gisle_aas:libwww-perl:5.15:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.16 cpe:2.3:a:gisle_aas:libwww-perl:5.16:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.17 cpe:2.3:a:gisle_aas:libwww-perl:5.17:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.18 cpe:2.3:a:gisle_aas:libwww-perl:5.18:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.18_03 cpe:2.3:a:gisle_aas:libwww-perl:5.18_03:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.18_04 cpe:2.3:a:gisle_aas:libwww-perl:5.18_04:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.18_05 cpe:2.3:a:gisle_aas:libwww-perl:5.18_05:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.19 cpe:2.3:a:gisle_aas:libwww-perl:5.19:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.20 cpe:2.3:a:gisle_aas:libwww-perl:5.20:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.21 cpe:2.3:a:gisle_aas:libwww-perl:5.21:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.22 cpe:2.3:a:gisle_aas:libwww-perl:5.22:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.30 cpe:2.3:a:gisle_aas:libwww-perl:5.30:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.31 cpe:2.3:a:gisle_aas:libwww-perl:5.31:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.32 cpe:2.3:a:gisle_aas:libwww-perl:5.32:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.33 cpe:2.3:a:gisle_aas:libwww-perl:5.33:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.34 cpe:2.3:a:gisle_aas:libwww-perl:5.34:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.35 cpe:2.3:a:gisle_aas:libwww-perl:5.35:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.36 cpe:2.3:a:gisle_aas:libwww-perl:5.36:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.41 cpe:2.3:a:gisle_aas:libwww-perl:5.41:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.42 cpe:2.3:a:gisle_aas:libwww-perl:5.42:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.43 cpe:2.3:a:gisle_aas:libwww-perl:5.43:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.44 cpe:2.3:a:gisle_aas:libwww-perl:5.44:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.45 cpe:2.3:a:gisle_aas:libwww-perl:5.45:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.46 cpe:2.3:a:gisle_aas:libwww-perl:5.46:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.47 cpe:2.3:a:gisle_aas:libwww-perl:5.47:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.48 cpe:2.3:a:gisle_aas:libwww-perl:5.48:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.49 cpe:2.3:a:gisle_aas:libwww-perl:5.49:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.50 cpe:2.3:a:gisle_aas:libwww-perl:5.50:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.51 cpe:2.3:a:gisle_aas:libwww-perl:5.51:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.52 cpe:2.3:a:gisle_aas:libwww-perl:5.52:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.53 cpe:2.3:a:gisle_aas:libwww-perl:5.53:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.53_90 cpe:2.3:a:gisle_aas:libwww-perl:5.53_90:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.53_91 cpe:2.3:a:gisle_aas:libwww-perl:5.53_91:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.53_92 cpe:2.3:a:gisle_aas:libwww-perl:5.53_92:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.53_93 cpe:2.3:a:gisle_aas:libwww-perl:5.53_93:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.53_94 cpe:2.3:a:gisle_aas:libwww-perl:5.53_94:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.53_95 cpe:2.3:a:gisle_aas:libwww-perl:5.53_95:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.53_96 cpe:2.3:a:gisle_aas:libwww-perl:5.53_96:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.53_97 cpe:2.3:a:gisle_aas:libwww-perl:5.53_97:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.60 cpe:2.3:a:gisle_aas:libwww-perl:5.60:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.61 cpe:2.3:a:gisle_aas:libwww-perl:5.61:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.62 cpe:2.3:a:gisle_aas:libwww-perl:5.62:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.63 cpe:2.3:a:gisle_aas:libwww-perl:5.63:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.64 cpe:2.3:a:gisle_aas:libwww-perl:5.64:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.65 cpe:2.3:a:gisle_aas:libwww-perl:5.65:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.66 cpe:2.3:a:gisle_aas:libwww-perl:5.66:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.67 cpe:2.3:a:gisle_aas:libwww-perl:5.67:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.68 cpe:2.3:a:gisle_aas:libwww-perl:5.68:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.69 cpe:2.3:a:gisle_aas:libwww-perl:5.69:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.70 cpe:2.3:a:gisle_aas:libwww-perl:5.70:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.71 cpe:2.3:a:gisle_aas:libwww-perl:5.71:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.72 cpe:2.3:a:gisle_aas:libwww-perl:5.72:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.73 cpe:2.3:a:gisle_aas:libwww-perl:5.73:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.74 cpe:2.3:a:gisle_aas:libwww-perl:5.74:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.75 cpe:2.3:a:gisle_aas:libwww-perl:5.75:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.76 cpe:2.3:a:gisle_aas:libwww-perl:5.76:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.77 cpe:2.3:a:gisle_aas:libwww-perl:5.77:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.78 cpe:2.3:a:gisle_aas:libwww-perl:5.78:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.79 cpe:2.3:a:gisle_aas:libwww-perl:5.79:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.800 cpe:2.3:a:gisle_aas:libwww-perl:5.800:*:*:*:*:*:*:*
gisle_aas libwww-perl 5.801 cpe:2.3:a:gisle_aas:libwww-perl:5.801:*:*:*:*:*:*:*

References for CVE-2011-0633

cvelogic Threat Intelligence