VulnerabilityModified

CVE-2020-25837

Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product.

HIGH 7.5EPSS 1.06%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.06%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product. The vulnerability affects versions 4.4.0.0 to 4.4.0.6 and 4.5.0.1 and 4.5.0.2. In certain configurations the vulnerability could disclose sensitive information.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 1.06% probability · 63th percentile
CISA KEV: Not listed
Affected: microfocus/self service password reset
Source: security@opentext.com

References

https://www.netiq.com/documentation/self-service-password-reset-44/release-notes-sspr-44-p7/data/release-notes-sspr-44-p7.html
https://www.netiq.com/documentation/self-service-password-reset-44/release-notes-sspr-44-p7/data/release-notes-sspr-44-p7.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.