CVE-2013-7259

NONE EPSS 65.8%
Published Apr 29, 201412y ago · Modified Jun 17, 20262w ago
Find Similar
Published Apr 29, 2014 12y ago
Last Modified Jun 17, 2026 2w ago

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.

Threat Intelligence

EPSS Exploit Probability
65.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 2

CWE-352 Cross-Site Request Forgery (CSRF) Authentication
CWE-78 OS Command Injection Injection

Affected Products 1

VendorProductVersionRange
neo4jneo4j1.9.2any

References 4

  • blog.diniscruz.com http://blog.diniscruz.com/2013/08/neo4j-csrf-payload-to-start-processes.html
  • openwall.com http://www.openwall.com/lists/oss-security/2014/01/03/3
  • openwall.com http://www.openwall.com/lists/oss-security/2014/01/03/8
  • github.com https://github.com/o2platform/DefCon_RESTing/tree/master/Live-Demos/Neo4j

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.