A man in the middle attacker can intercept and send a different certificate (a self-signed one, maybe) to the browser. In this case, browser will show warning to the user and doesn't display's the green pad lock near the URL.

If a single user bypasses the warning, will he still be prone to a man in the middle attack?

How can this issue be overcome? Is it solely left to the end user?