Neuvector 3.1 and below to authenticate as a valid AD LDAP user using a blank password

Overview :
NeuVector 3.1 when configured to allow authentication via Active Directory, does not enforce non-empty passwords which allows an attacker with access to the Neuvector portal to authenticate as any valid LDAP user by providing a valid username and an empty password (provided that the active directory server has not been configured to reject empty passwords).
Affected Product(s) :
  • NeuVector 3.1
Vulnerability Details :
CVE ID : CVE-2019-19747
If a user performs a successful unauthenticated simple bind, because a session has been created, the LDAP client assumes the user is an authenticated user and NOT an anonymous user. This means anyone with a valid LDAP username can authenticate and gain access to the application without that user’s password

Solution :

Neuvector issued a patch with the fix on the 17th of December 2019

Common Vulnerabilityies and Exposures

Contact us to get started

CVE-2024-10698 : TENDA AC6 15.03.05.19 /GOFORM/SETONLINEDEVNAME FORMSETDEVICENAME DEVNAME STACK-BASED OVERFLOW

CVE-2024-10698 : TENDA AC6 15.03.05.19 /GOFORM/SETONLINEDEVNAME FORMSETDEVICENAME DEVNAME STACK-BASED OVERFLOW

Description A vulnerability was found in Tenda AC6 15.03.05.19 and classified as critical. Affected by this issue is the function

CVE-2024-41745 : IBM CICS TX STANDARD 11.1 WEB UI CROSS SITE SCRIPTING

CVE-2024-41745 : IBM CICS TX STANDARD 11.1 WEB UI CROSS SITE SCRIPTING

Description IBM CICS TX Standard is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript

CVE-2024-49770 : OAK UP TO 17.1.2 API CONTEXT.SEND PATH TRAVERSAL

CVE-2024-49770 : OAK UP TO 17.1.2 API CONTEXT.SEND PATH TRAVERSAL

Description `oak` is a middleware framework for Deno’s native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and