CVE-2019-19747: Critical severity neuvector vulnerability
NeuVector 3.1 when configured to allow authentication via Active Directory, does not enforce non-empty passwords which allows an attacker with access to the Neuvector portal to authenticate as any valid LDAP user by providing a valid username and an empty password (provided that the active directory server has not been configured to reject empty passwords).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19747?
CVE-2019-19747 is considered to be of high severity due to the security implications of allowing authentication with empty passwords.
How do I fix CVE-2019-19747?
To fix CVE-2019-19747, ensure that the configuration enforces non-empty passwords for LDAP users in NeuVector.
What systems are affected by CVE-2019-19747?
CVE-2019-19747 affects NeuVector versions up to and including 3.1 when configured for Active Directory authentication.
Can an attacker exploit CVE-2019-19747 remotely?
Yes, an attacker with access to the NeuVector portal can exploit CVE-2019-19747 remotely by using a valid LDAP username and an empty password.
What kind of authentication issue does CVE-2019-19747 represent?
CVE-2019-19747 represents a critical authentication flaw due to the lack of enforcement for non-empty passwords within the system.