Overview :
NeuVector 3.1 when configured to allow authentication via Active Directory, does not enforce non-empty passwords which allows an attacker with access to the Neuvector portal to authenticate as any valid LDAP user by providing a valid username and an empty password (provided that the active directory server has not been configured to reject empty passwords).
Affected Product(s) :
  • NeuVector 3.1
Vulnerability Details :
CVE ID : CVE-2019-19747
If a user performs a successful unauthenticated simple bind, because a session has been created, the LDAP client assumes the user is an authenticated user and NOT an anonymous user. This means anyone with a valid LDAP username can authenticate and gain access to the application without that user’s password

Solution :

Neuvector issued a patch with the fix on the 17th of December 2019