CVE-2019-11674

Published: Oct 22, 2019Modified: Jun 17, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4. The vulnerability could exploit invalid certificate validation and may result in a man-in-the-middle attack.

Affected (5)

Products: Microfocus: Netiq Self Service Password Reset

Microfocus

1 product

Netiq Self Service Password Reset

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Microfocus Netiq Self Service Password Reset	Up to 4.3
Microfocus Netiq Self Service Password Reset	Version 4.4
Microfocus Netiq Self Service Password Reset	Version 4.4 update_1
Microfocus Netiq Self Service Password Reset	Version 4.4 update_2
Microfocus Netiq Self Service Password Reset	Version 4.4 update_3

Related CWEs

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (2)

https://www.netiq.com/documentation/self-service-password-reset-44/release-notes-sspr-44-p4/data/release-notes-sspr-44-p4.html

Source: security@opentext.com

https://www.netiq.com/documentation/self-service-password-reset-44/release-notes-sspr-44-p4/data/release-notes-sspr-44-p4.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.