PT-2019-12472 · Micro Focus · Micro Focus Self Service Password Reset

Publicado 2019-10-22 · Atualizado 2019-10-24 · CVE-2019-11674

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Micro Focus Self Service Password Reset versions prior to 4.4.0.4

Description The issue concerns a man-in-the-middle vulnerability that exploits invalid certificate validation, potentially resulting in a man-in-the-middle attack.

Recommendations For versions prior to 4.4.0.4, update to version 4.4.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Self Service Password Reset feature until the update is applied.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2019-11674

Produtos afetados

Micro Focus Self Service Password Reset

Referências · 3

• https://netiq.com/documentation/self-service-password-reset-44/release-notes-sspr-44-p4/data/release-notes-sspr-44-p4.html · Nota
• https://osv.dev/vulnerability/CVE-2019-11674 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11674 · Nota de Segurança