Description

Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password.

Remediation

References

https://github.com/neo4j/neo4j/issues/12047

Related Vulnerabilities

CVE-2023-29506 Vulnerability in maven package org.xwiki.platform:xwiki-platform-security-authentication-default

CVE-2022-31198 Vulnerability in maven package org.webjars.npm:openzeppelin__contracts

CVE-2022-31147 Vulnerability in maven package org.webjars.bower:jquery-validation

CVE-2020-7769 Vulnerability in npm package nodemailer

CVE-2020-7683 Vulnerability in npm package rollup-plugin-server

Severity

Critical

Classification

CWE-287 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory