GitHub Advisoryadvisory · Maven

GHSA-h5f5-rj4r-42f6 Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication

CRITICAL Published 2018-10-17 Modified 2022-04-27 Official page ↗
Aliases
CVE-2018-18389
Ecosystem
Maven
Packages
org.neo4j:neo4j-enterprise
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2020-06-16

Affected packages

• Maven org.neo4j:neo4j-enterprise: >= 3.4.0, < 3.4.9 → fixed in 3.4.9

Description

Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password.

Related

Alias · CVE (1)

  • CVE-2018-18389 Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References