PT-2018-14432

CVE-2018-18389

Publicado

2018-10-16

Atualizado

2019-01-18

Descrição por

CVSS 3.1

9.8

Crítica

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Neo4j Enterprise Database Server versions 3.4.x through 3.4.8

Description The issue arises from incorrect access control, allowing an attacker to log into the server by sending any valid username with an arbitrary password when LDAP is set for authentication with STARTTLS and System Account is used for authorization.

Recommendations For Neo4j Enterprise Database Server versions 3.4.x through 3.4.8, update to version 3.4.9 or later to resolve the issue.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Oschlueter

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-287: Improper Authentication

Identificadores relacionados