High severity · published Nov 5, 2020
CVE-2020-25837
Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product
7.5
CVSS
1.1%
EPSS
No
On KEV
Description
Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product. The vulnerability affects versions 4.4.0.0 to 4.4.0.6 and 4.5.0.1 and 4.5.0.2. In certain configurations the vulnerability could disclose sensitive information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Self Service Password Reset · Microfocus
4.4.0.0 through 4.4.0.6; 4.5.0.1 through 4.5.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25837
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25837
www.netiq.com
https://www.netiq.com/documentation/self-service-password-reset-44/release-notes-sspr-44-p7/data/release-notes-sspr-44-p7.html
More from Self Service Password Reset
6.1
CVE-2016-1599
Cross-site scripting (XSS) vulnerability in NetIQ Self Service Password Reset (SSPR) 2.x and 3.x before 3.3.1 HF2 allows remote attackers to inject arbitrary web script or HTML…