Access Control Flaw in Neo4j Enterprise Database Server
CVE-2018-18389

9.8CRITICAL

Key Information:

Vendor

Neo4j

Status
Neo4j
Vendor
CVE Published:
16 October 2018

What is CVE-2018-18389?

An access control vulnerability exists in Neo4j Enterprise Database Server versions 3.4.x prior to 3.4.9. Due to improper handling of user authentication and authorization, an attacker can exploit this flaw by utilizing valid usernames along with arbitrary passwords to gain unauthorized access to the database server. This issue may lead to significant security risks, including unauthorized data access and manipulation, highlighting the importance of timely updates and patches for database systems.

References

https://github.com/neo4j/neo4j/issues/12047
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.