{"cve":"CVE-2011-0633","nvd":{"published":"2011-05-13T22:55:01.610","modified":"2026-06-16T23:27:46.963","status":"Modified","description":"The Net::HTTPS module in libwww-perl (LWP) before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof servers via man-in-the-middle (MITM) attacks involving hostnames that are not properly validated.  NOTE: it could be argued that this is a design limitation of the Net::HTTPS API, and separate implementations should be independently assigned CVE identifiers for not working around this limitation. However, because this API was modified within LWP, a single CVE identifier has been assigned.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-20"],"references":["http://cpansearch.perl.org/src/GAAS/libwww-perl-6.02/Changes","http://vttynotes.blogspot.com/2010/12/man-in-middle-fun-with-perl-lwp.html","http://vttynotes.blogspot.com/2011/03/quick-note-on-lwp-and-perl-security-cve.html","http://cpansearch.perl.org/src/GAAS/libwww-perl-6.02/Changes","http://vttynotes.blogspot.com/2010/12/man-in-middle-fun-with-perl-lwp.html"],"products":["gisle_aas:libwww-perl","search.cpan:libwww-perl"],"source":"nvd","synced_at":"2026-10-19T19:58:50.521460154+00:00"},"epss":{"cve":"CVE-2011-0633","score":0.04246,"percentile":0.91043,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}