PT-2019-15945 · Neuvector · Neuvector

Published 2019-12-20 · Updated 2020-01-03 · CVE-2019-19747

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NeuVector version 3.1

Description The issue allows an attacker with access to the NeuVector portal to authenticate as any valid LDAP user by providing a valid username and an empty password, given that the Active Directory server has not been configured to reject empty passwords. This occurs when NeuVector is configured to allow authentication via Active Directory.

Recommendations For NeuVector version 3.1, consider configuring the Active Directory server to reject empty passwords as a mitigation measure. Additionally, restrict access to the NeuVector portal to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2019-19747

Affected Products

Neuvector

References · 4

• 🔥 https://paulrobertson.co.za/cve-2019-19747 · Exploit
• https://osv.dev/vulnerability/CVE-2019-19747 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19747 · Security Note
• https://neuvector.com/container-security/blog · Vendor Advisory