CVE-2013-7259 Neo4J vulnerable to Cross-Site Request Forgery
CSRF vulnerabilities in Neo4j allow attackers to hijack admin sessions and execute arbitrary code via crafted requests.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2013-7259?
CVE-2013-7259 is a medium-severity vulnerability in n/a, published on 29 Apr 2014. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.
Which versions are affected by CVE-2013-7259?
2 open source packages ship an affected version, including org.neo4j:neo4j. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.neo4j:neo4j Maven | All versions | 2.2.0-M01 |
org.neo4j:neo4j Maven | All versions | 2.2.0-M01 |
Products include Neo4j Neo4j.
How do I fix CVE-2013-7259?
Upgrade org.neo4j:neo4j to 2.2.0-M01 or later.
Is CVE-2013-7259 being exploited?
There is no known exploitation of CVE-2013-7259 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-34371 Deserialization of Untrusted Data in Neo4j
- CVE-2018-18389 Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication
- CVE-2024-34517 Neo4j Cypher component mishandles IMMUTABLE privileges
- CVE-2026-14587 Unathenticated connection can hold Bolt channel open
- CVE-2026-1471 Caching of authentication context
Sources
Also known as GHSA-x626-q4v7-7xc6.