« Volver al listado

CVE-2019-11652

Estado: ModificadaCrítica (9.8)—

A potential authorization bypass issue was found in Micro Focus Self Service Password Reset (SSPR) versions prior to: 4.4.0.3, 4.3.0.6, and 4.2.0.6. Upgrade to Micro Focus Self Service Password Reset (SSPR) SSPR versions 4.4.0.3, 4.3.0.6, or 4.2.0.6 as appropriate.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microfocus — Netiq Self Service Password Reset

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-11652",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@opentext.com",
      "affectedData": [
        {
          "vendor": "Micro Focus",
          "product": "Self Service Password Reset (SSPR)",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 4.4.0.3"
            },
            {
              "status": "affected",
              "version": "prior to 4.3.0.6"
            },
            {
              "status": "affected",
              "version": "prior to 4.2.0.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-08-14T16:15:12.643",
  "references": [
    {
      "url": "https://www.netiq.com/documentation/self-service-password-reset-42/release-notes-sspr42-p6/data/release-notes-sspr42-p6.html",
      "source": "security@opentext.com"
    },
    {
      "url": "https://www.netiq.com/documentation/self-service-password-reset-43/release-notes-sspr-43-p3/data/release-notes-sspr-43-p3.html",
      "source": "security@opentext.com"
    },
    {
      "url": "https://www.netiq.com/documentation/self-service-password-reset-44/release-notes-sspr-44-p3/data/release-notes-sspr-44-p3.html",
      "source": "security@opentext.com"
    },
    {
      "url": "https://www.netiq.com/documentation/self-service-password-reset-42/release-notes-sspr42-p6/data/release-notes-sspr42-p6.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.netiq.com/documentation/self-service-password-reset-43/release-notes-sspr-43-p3/data/release-notes-sspr-43-p3.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.netiq.com/documentation/self-service-password-reset-44/release-notes-sspr-44-p3/data/release-notes-sspr-44-p3.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A potential authorization bypass issue was found in Micro Focus Self Service Password Reset (SSPR) versions prior to: 4.4.0.3, 4.3.0.6, and 4.2.0.6. Upgrade to Micro Focus Self Service Password Reset (SSPR) SSPR versions 4.4.0.3, 4.3.0.6, or 4.2.0.6 as appropriate."
    },
    {
      "lang": "es",
      "value": "Se encontró un problema potencial de omisión de autorización en Micro Focus Self Service Password Reset (SSPR), versiones  anteriores a: 4.4.0.3, 4.3.0.6 y 4.2.0.6. Actualización para Micro Focus Self Service Password Reset (SSPR) versiones de SSPR 4.4.0.3, 4.3.0.6 o 4.2.0.6 según corresponda."
    }
  ],
  "lastModified": "2026-06-17T02:13:20.970",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microfocus:netiq_self_service_password_reset:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F0C4AE1-FCD1-4360-B69E-F94EBC4220C7",
              "versionEndExcluding": "4.2.0.6",
              "versionStartIncluding": "4.2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:netiq_self_service_password_reset:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E3607F1-C736-43C8-A7A6-EA0AFFAA041A",
              "versionEndExcluding": "4.3.0.6",
              "versionStartIncluding": "4.3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:netiq_self_service_password_reset:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02C30A5F-E3B4-43FE-9640-3A28F55649A3",
              "versionEndExcluding": "4.4.0.3",
              "versionStartIncluding": "4.4.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@opentext.com"
}