CVE-2011-1398

CVE-2011-1398 describes an HTTP response-splitting vulnerability in PHP versions before 5.3.11 and 5.4.x before 5.4.0RC2. The sapi_header_op function fails to properly sanitize carriage return characters (%0D), allowing remote attackers to bypass HTTP response-splitting protections. This vulnerability, related to the interaction between the PHP header function and certain browsers like Internet Explorer and Google Chrome, could lead to content injection or other malicious activities. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack vector with medium complexity and potential for partial integrity impact (AV:N/AC:M/I:P). While not actively exploited in the wild (KEV: No), an ExploitDB entry (EDB-37688) confirms the existence of exploit code for HTTP header injection. Despite the availability of exploit code, there is no evidence of active exploitation, and community discussion and media coverage are minimal, suggesting low public awareness or impact. The EPSS score is low, further indicating a low probability of exploitation in the wild.