CVE-2018-18389
Last modified
CVE-2018-18389 is a vulnerability of currently unknown severity. Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password.. EPSS estimates a 1.92% chance of exploitation in the next 30 days.
Description
Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Neo4j | Neo4j | >= 3.4.0, < 3.4.9 |
References
- https://github.com/neo4j/neo4j/issues/12047Exploit, Third Party Advisory
- https://github.com/neo4j/neo4j/issues/12047Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-18389?
How severe is CVE-2018-18389?
How do I fix CVE-2018-18389?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-18382Advanced HRM 1.6 allows Remote Code Execution via PHP code i…
- CVE-2018-18384Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a Z…
- CVE-2018-18385Asciidoctor in versions < 1.5.8 allows remote attackers to c…
- CVE-2018-18386drivers/tty/n_tty.c in the Linux kernel before 4.14.11 allow…
- CVE-2018-18387playSMS through 1.4.2 allows Privilege Escalation through Da…
- CVE-2018-18388eScan Agent Application (MWAGENT.EXE) 4.0.2.98 in MicroWorld…
- CVE-2018-18390User Enumeration in Moxa ThingsPro IIoT Gateway and Device M…
- CVE-2018-18391User Privilege Escalation in Moxa ThingsPro IIoT Gateway and…
- CVE-2018-18392Privilege Escalation via Broken Access Control in Moxa Thing…
- CVE-2018-18393Password Management Issue in Moxa ThingsPro IIoT Gateway and…
- CVE-2018-18394Sensitive Information Stored in Clear Text in Moxa ThingsPro…
- CVE-2018-18395Hidden Token Access in Moxa ThingsPro IIoT Gateway and Devic…
Are you affected by CVE-2018-18389?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST