CVE-2018-18389

Published: Oct 16, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password.

Affected (1)

Products: Neo4j: Neo4j

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Neo4j Neo4j	From 3.4.0 to 3.4.9

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://github.com/neo4j/neo4j/issues/12047

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/neo4j/neo4j/issues/12047

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.