CVE-2019-11674

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-22 · updated 2026-06-17
Weakness: CWE-295

Description

Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4. The vulnerability could exploit invalid certificate validation and may result in a man-in-the-middle attack.

Affected products

OpenText Self Service Password Reset: through 4.3; 4.4, 4.4-update_1, 4.4-update_2, 4.4-update_3

References

https://www.netiq.com/documentation/self-service-password-reset-44/release-notes-sspr-44-p4/data/release-notes-sspr-44-p4.html
https://www.netiq.com/documentation/self-service-password-reset-44/release-notes-sspr-44-p4/data/release-notes-sspr-44-p4.html

Get alerted when CVE-2019-11674 or the next vulnerability affects your stack