PT-2020-16235 · Micro Focus · Micro Focus Self Service Password Reset

Published 2020-11-05 · Updated 2021-07-21 · CVE-2020-25837

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Micro Focus Self Service Password Reset (SSPR) versions 4.4.0.0 through 4.4.0.6 Micro Focus Self Service Password Reset (SSPR) versions 4.5.0.1 through 4.5.0.2

Description The issue is a sensitive information disclosure vulnerability. It could disclose sensitive information in certain configurations.

Recommendations For versions 4.4.0.0 through 4.4.0.6, update to a version outside of this range to resolve the issue. For versions 4.5.0.1 through 4.5.0.2, update to a version outside of this range to resolve the issue.

Fix

Related Identifiers

CVE-2020-25837

Affected Products

Micro Focus Self Service Password Reset

References · 4

• https://osv.dev/vulnerability/CVE-2020-25837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25837 · Security Note
• https://netiq.com/documentation/self-service-password-reset-44/release-notes-sspr-44-p7/data/release-notes-sspr-44-p7.html · Note
• https://t.me/cibsecurity/15918 · Telegram Post