What is GHSA-h5f5-rj4r-42f6?

GHSA-h5f5-rj4r-42f6 is a security advisory published by GitHub Security Advisories with Critical severity. Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication

Which CVE IDs does GHSA-h5f5-rj4r-42f6 cover?

GHSA-h5f5-rj4r-42f6 covers the following CVE IDs: CVE-2018-18389. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h5f5-rj4r-42f6?

GHSA-h5f5-rj4r-42f6 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-h5f5-rj4r-42f6?

GHSA-h5f5-rj4r-42f6 affects 1 product, including: maven/org.neo4j:neo4j-enterprise:\u003e= 3.4.0, \u003c 3.4.9.

GHSA-h5f5-rj4r-42f6CriticalCVSS 9.8

Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication

Vendor

GitHub Security Advisories

Published

October 17, 2018

Last Modified

April 5, 2023

🔗 CVE IDs covered (1)

CVE-2018-18389 →

📋 Description

Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password.

🎯 Affected products1

maven/org.neo4j:neo4j-enterprise:>= 3.4.0, < 3.4.9

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-18389
https://github.com/neo4j/neo4j/issues/12047
https://github.com/advisories/GHSA-h5f5-rj4r-42f6
https://github.com/neo4j/neo4j/commit/46de5d01ae2741ffe04c36270fc62c6d490f65c9