CVE-2020-11850

Published: Aug 21, 2024Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Cross-Site Scripting (XSS). This issue affects Self Service Password Reset before 4.5.0.2 and 4.4.0.6

Affected (9)

Products: Microfocus: Netiq Self Service Password Reset

Microfocus

1 product

Netiq Self Service Password Reset

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Microfocus Netiq Self Service Password Reset	Before 4.4
Microfocus Netiq Self Service Password Reset	Version 4.4
Microfocus Netiq Self Service Password Reset	Version 4.4 update_1
Microfocus Netiq Self Service Password Reset	Version 4.4 update_2
Microfocus Netiq Self Service Password Reset	Version 4.4 update_3
Microfocus Netiq Self Service Password Reset	Version 4.4 update_4
Microfocus Netiq Self Service Password Reset	Version 4.4 update_5
Microfocus Netiq Self Service Password Reset	Version 4.5
Microfocus Netiq Self Service Password Reset	Version 4.5 update_1

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

https://www.netiq.com/documentation/self-service-password-reset-45/sspr-4502-release-notes/data/sspr-4502-release-notes.html#b149gz5h

Source: security@opentext.com

Release Notes

Timeline

No history available yet.