Sensitive Information Disclosure in Micro Focus Self Service Password Reset
CVE-2020-25837

7.5HIGH

Key Information:

Vendor

Microfocus
Status
Micro Focus Self Service Password Reset (sspr)
Vendor
CVE Published:
5 November 2020

What is CVE-2020-25837?

A vulnerability in the Micro Focus Self Service Password Reset (SSPR) product exposes sensitive information under specific configurations. This issue affects versions 4.4.0.0 through 4.4.0.6 and 4.5.0.1, 4.5.0.2, potentially allowing unauthorized access to confidential data for malicious actors. Users of the affected versions should review their configurations and consider upgrading to secure their systems.

Affected Version(s)

Micro Focus Self Service Password Reset (SSPR) 4.4.0.0 to 4.4.0.6 and 4.5.0.1 and 4.5.0.2

References

https://www.netiq.com/documentation/self-service-password...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.