CVE-2018-18389: NEO4J

Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days.

Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password.

Affected products

• NEO4J NEO4J: from 3.4.0, before 3.4.9 (fixed in 3.4.9)

Published 2018-10-16. Last modified 2026-06-17.