PT-2019-15945 · Neuvector · Neuvector

Publicado 2019-12-20 · Atualizado 2020-01-03 · CVE-2019-19747

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NeuVector version 3.1

Description The issue allows an attacker with access to the NeuVector portal to authenticate as any valid LDAP user by providing a valid username and an empty password, given that the Active Directory server has not been configured to reject empty passwords. This occurs when NeuVector is configured to allow authentication via Active Directory.

Recommendations For NeuVector version 3.1, consider configuring the Active Directory server to reject empty passwords as a mitigation measure. Additionally, restrict access to the NeuVector portal to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-521

Identificadores relacionados

CVE-2019-19747

Produtos afetados

Neuvector

Referências · 4

• 🔥 https://paulrobertson.co.za/cve-2019-19747 · Exploit
• https://osv.dev/vulnerability/CVE-2019-19747 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19747 · Nota de Segurança
• https://neuvector.com/container-security/blog · Aviso do Fabricante