CVE-2013-7259 Neo4J vulnerable to Cross-Site Request Forgery

MediumCVSS 6.8 EPSS 1.3%

Published: 2014-04-29 17:00
Updated: 2026-06-17 03:01
Exploit status: No public exploit known

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.

Affected products

Product	Affected versions	Fixed in
org.neo4j/neo4j(Maven)	< 2.2.0-M01	2.2.0-M01
org.neo4j/neo4j(Maven)	= 1.2	No fix listed
org.neo4j/neo4j(Maven)	= 1.2.M01	No fix listed
org.neo4j/neo4j(Maven)	= 1.2.M02	No fix listed
org.neo4j/neo4j(Maven)	= 1.2.M03	No fix listed
org.neo4j/neo4j(Maven)	= 1.2.M04	No fix listed
org.neo4j/neo4j(Maven)	= 1.2.M05	No fix listed
org.neo4j/neo4j(Maven)	= 1.2.M06	No fix listed
org.neo4j/neo4j(Maven)	= 1.3	No fix listed
org.neo4j/neo4j(Maven)	= 1.3.M01	No fix listed
org.neo4j/neo4j(Maven)	= 1.3.M02	No fix listed
org.neo4j/neo4j(Maven)	= 1.3.M03	No fix listed
org.neo4j/neo4j(Maven)	= 1.3.M04	No fix listed
org.neo4j/neo4j(Maven)	= 1.3.M05	No fix listed
org.neo4j/neo4j(Maven)	= 1.4	No fix listed
org.neo4j/neo4j(Maven)	= 1.4.1	No fix listed
org.neo4j/neo4j(Maven)	= 1.4.2	No fix listed
org.neo4j/neo4j(Maven)	= 1.4.M01	No fix listed
org.neo4j/neo4j(Maven)	= 1.4.M02	No fix listed
org.neo4j/neo4j(Maven)	= 1.4.M03	No fix listed
org.neo4j/neo4j(Maven)	= 1.4.M04	No fix listed
org.neo4j/neo4j(Maven)	= 1.4.M05	No fix listed
org.neo4j/neo4j(Maven)	= 1.4.M06	No fix listed
org.neo4j/neo4j(Maven)	= 1.5	No fix listed
org.neo4j/neo4j(Maven)	= 1.5.1	No fix listed

Show 73 more

Product	Affected versions	Fixed in
org.neo4j/neo4j(Maven)	= 1.5.2	No fix listed
org.neo4j/neo4j(Maven)	= 1.5.3	No fix listed
org.neo4j/neo4j(Maven)	= 1.5.M01	No fix listed
org.neo4j/neo4j(Maven)	= 1.5.M02	No fix listed
org.neo4j/neo4j(Maven)	= 1.6	No fix listed
org.neo4j/neo4j(Maven)	= 1.6.1	No fix listed
org.neo4j/neo4j(Maven)	= 1.6.2	No fix listed
org.neo4j/neo4j(Maven)	= 1.6.3	No fix listed
org.neo4j/neo4j(Maven)	= 1.6.M01	No fix listed
org.neo4j/neo4j(Maven)	= 1.6.M02	No fix listed
org.neo4j/neo4j(Maven)	= 1.6.M03	No fix listed
org.neo4j/neo4j(Maven)	= 1.7	No fix listed
org.neo4j/neo4j(Maven)	= 1.7.1	No fix listed
org.neo4j/neo4j(Maven)	= 1.7.2	No fix listed
org.neo4j/neo4j(Maven)	= 1.7.M01	No fix listed
org.neo4j/neo4j(Maven)	= 1.7.M02	No fix listed
org.neo4j/neo4j(Maven)	= 1.7.M03	No fix listed
org.neo4j/neo4j(Maven)	= 1.8	No fix listed
org.neo4j/neo4j(Maven)	= 1.8.1	No fix listed
org.neo4j/neo4j(Maven)	= 1.8.2	No fix listed
org.neo4j/neo4j(Maven)	= 1.8.3	No fix listed
org.neo4j/neo4j(Maven)	= 1.8.M01	No fix listed
org.neo4j/neo4j(Maven)	= 1.8.M02	No fix listed
org.neo4j/neo4j(Maven)	= 1.8.M03	No fix listed
org.neo4j/neo4j(Maven)	= 1.8.M04	No fix listed
org.neo4j/neo4j(Maven)	= 1.8.M05	No fix listed
org.neo4j/neo4j(Maven)	= 1.8.M06	No fix listed
org.neo4j/neo4j(Maven)	= 1.8.M07	No fix listed
org.neo4j/neo4j(Maven)	= 1.8.RC1	No fix listed
org.neo4j/neo4j(Maven)	= 1.9	No fix listed
org.neo4j/neo4j(Maven)	= 1.9.1	No fix listed
org.neo4j/neo4j(Maven)	= 1.9.2	No fix listed
org.neo4j/neo4j(Maven)	= 1.9.3	No fix listed
org.neo4j/neo4j(Maven)	= 1.9.4	No fix listed
org.neo4j/neo4j(Maven)	= 1.9.5	No fix listed
org.neo4j/neo4j(Maven)	= 1.9.6	No fix listed
org.neo4j/neo4j(Maven)	= 1.9.7	No fix listed
org.neo4j/neo4j(Maven)	= 1.9.8	No fix listed
org.neo4j/neo4j(Maven)	= 1.9.9	No fix listed
org.neo4j/neo4j(Maven)	= 1.9.M01	No fix listed
org.neo4j/neo4j(Maven)	= 1.9.M02	No fix listed
org.neo4j/neo4j(Maven)	= 1.9.M03	No fix listed
org.neo4j/neo4j(Maven)	= 1.9.M04	No fix listed
org.neo4j/neo4j(Maven)	= 1.9.M05	No fix listed
org.neo4j/neo4j(Maven)	= 1.9.RC1	No fix listed
org.neo4j/neo4j(Maven)	= 1.9.RC2	No fix listed
org.neo4j/neo4j(Maven)	= 2.0.0	No fix listed
org.neo4j/neo4j(Maven)	= 2.0.0-M01	No fix listed
org.neo4j/neo4j(Maven)	= 2.0.0-M02	No fix listed
org.neo4j/neo4j(Maven)	= 2.0.0-M03	No fix listed
org.neo4j/neo4j(Maven)	= 2.0.0-M04	No fix listed
org.neo4j/neo4j(Maven)	= 2.0.0-M05	No fix listed
org.neo4j/neo4j(Maven)	= 2.0.0-M06	No fix listed
org.neo4j/neo4j(Maven)	= 2.0.0-RC1	No fix listed
org.neo4j/neo4j(Maven)	= 2.0.1	No fix listed
org.neo4j/neo4j(Maven)	= 2.0.2	No fix listed
org.neo4j/neo4j(Maven)	= 2.0.3	No fix listed
org.neo4j/neo4j(Maven)	= 2.0.4	No fix listed
org.neo4j/neo4j(Maven)	= 2.0.5	No fix listed
org.neo4j/neo4j(Maven)	= 2.1.0	No fix listed
org.neo4j/neo4j(Maven)	= 2.1.0-M01	No fix listed
org.neo4j/neo4j(Maven)	= 2.1.0-M02	No fix listed
org.neo4j/neo4j(Maven)	= 2.1.0-RC1	No fix listed
org.neo4j/neo4j(Maven)	= 2.1.0-RC2	No fix listed
org.neo4j/neo4j(Maven)	= 2.1.1	No fix listed
org.neo4j/neo4j(Maven)	= 2.1.2	No fix listed
org.neo4j/neo4j(Maven)	= 2.1.3	No fix listed
org.neo4j/neo4j(Maven)	= 2.1.4	No fix listed
org.neo4j/neo4j(Maven)	= 2.1.5	No fix listed
org.neo4j/neo4j(Maven)	= 2.1.6	No fix listed
org.neo4j/neo4j(Maven)	= 2.1.7	No fix listed
org.neo4j/neo4j(Maven)	= 2.1.8	No fix listed
neo4j	= 1.9.2	No fix listed

References

nvd.nist.gov third-party-advisory vendor-advisory
github.com
github.com patch
github.com product
github.com
web.archive.org
[oss-security] 20140103 Neo4J CSRF: Potential CVE candidate mailing-list
[oss-security] 20140103 Re: Neo4J CSRF: Potential CVE candidate mailing-list
blog.diniscruz.com
github.com

CVSS v2.0

6.8 Medium

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Medium
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

All scores (3)

v4.0 – · osv:ghsa
v4.0 8.9 · github
v2.0 6.8 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.25% (percentile 69.9)
CWE: CWE-352 Cross-Site Request Forgery CWE-78 Improper Neutralization of Special Elements used in an OS Command

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.