CVE-2018-18389

9.8 criticalEPSS 1.9%

Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2018-10-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

neo4j:neo4j

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-h5f5-rj4r-42f6	Maven	org.neo4j:neo4j-enterprise	>=3.4.0 <3.4.9	3.4.9

References

https://github.com/neo4j/neo4j/issues/12047
https://github.com/neo4j/neo4j/issues/12047

Check your stack JSON