CVE-2019-19747

CRITICAL

NeuVector < 3.1 - Unauthenticated Authentication Bypass via Empty LDAP Password

Title source: llm
STIX 2.1

Description

NeuVector 3.1 when configured to allow authentication via Active Directory, does not enforce non-empty passwords which allows an attacker with access to the Neuvector portal to authenticate as any valid LDAP user by providing a valid username and an empty password (provided that the active directory server has not been configured to reject empty passwords).

References (2)

Core 2
Core References
Vendor Advisory x_refsource_misc
https://neuvector.com/container-security/blog/
Exploit, Third Party Advisory x_refsource_misc
https://paulrobertson.co.za/cve-2019-19747/

Scores

CVSS v3 9.8
EPSS 0.0139
EPSS Percentile 68.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-521
Status published
Products (1)
neuvector/neuvector < 3.1
Published Dec 20, 2019
Tracked Since Feb 18, 2026