Micro Focus Netiq Self Service Password Reset vulnerabilities

4 CVEs affecting Micro Focus Netiq Self Service Password Reset, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-11850, published 2024-08-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-11652, published 2019-08-14. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. A potential authorization bypass issue was found in Micro Focus Self Service Password Reset (SSPR) versions prior to: 4.4.0.3, 4.3.0.6, and 4.2.0.6. Upgrade to Micro Focus Self Service Password Reset…
CVE-2019-11647, published 2019-06-24. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. A potential XSS exists in Self Service Password Reset, in Micro Focus NetIQ Software all versions prior to version 4.4. The vulnerability could be exploited to enable an XSS attack.
CVE-2019-11674, published 2019-10-22. Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days. Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4. The vulnerability could exploit invalid certificate validation and may result in a…
CVE-2020-11850, published 2024-08-21. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Cross-Site Scripting (XSS). This issue affects Self Service Password Reset before 4.5.0.2 and 4.4.0.6