CVE-2018-18389
Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication
9.8
CRITICAL
CVSS 3.1
EPSS 0.73%
Description
Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password.
How to fix CVE-2018-18389
To remediate CVE-2018-18389, upgrade the affected package to a fixed version below.
- —upgrade to 3.4.9 or later
Is CVE-2018-18389 being exploited?
Low — EPSS is 0.7%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 3.4.0, < 3.4.9
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |