Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication

CRITICO 9.8CVE-2018-18389 · GHSA-h5f5-rj4r-42f6 · Published 16/10/2018 · updated 17/06/2026

In breve

CVE-2018-18389 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda org.neo4j:neo4j-enterprise, neo4j (neo4j).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.9%, superiore al 79.9% delle vulnerabilità.
Correzione: aggiornare a 3.4.9 o successiva.

Package	Affected versions	Patched versions
org.neo4j:neo4j-enterprise Maven	`≥ 3.4.0, < 3.4.9`	`3.4.9`
neo4j neo4j	`≥ 3.4.0, < 3.4.9`	`3.4.9`

Description

Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-18389 · ADVISORY
neo4j/neo4j · WEB
neo4j/neo4j commit 46de5d0 · WEB
GitHub Advisory GHSA-h5f5-rj4r-42f6 · ADVISORY
neo4j/neo4j · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free