GHSA-h5f5-rj4r-42f6

Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-18389

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.neo4j:neo4j-enterprise	>= 3.4.0, < 3.4.9	3.4.9

Details

As written in the advisory (Markdown source, shown as plain text).

Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-18389 advisory
https://github.com/neo4j/neo4j/issues/12047 web
https://github.com/neo4j/neo4j/commit/46de5d01ae2741ffe04c36270fc62c6d490f65c9 web
https://github.com/advisories/GHSA-h5f5-rj4r-42f6 advisory
https://github.com/neo4j/neo4j package