CVE-2013-7259
Neo4J vulnerable to Cross-Site Request Forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.
- Record
CVE-2013-7259- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-78, CWE-352
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.
- Record
CVE-2013-7259- Updated
- 2026-11-02
EUVDEUVD-2013-7037 No score
Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.
- Record
EUVD-2013-7037- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x626-q4v7-7xc6
Neo4J vulnerable to Cross-Site Request Forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.
- Record
GHSA-x626-q4v7-7xc6- CVSS 4.0
- 8.9 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-78, CWE-352
- Updated
- 2026-11-02
OSVGHSA-x626-q4v7-7xc6
Neo4J vulnerable to Cross-Site Request Forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.
- Record
GHSA-x626-q4v7-7xc6- CVSS 4.0
- 8.9 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-352, CWE-78
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.neo4j:neo4jMaven |
before 2.2.0-M01 | 2.2.0-M01 |
org.neo4j:neo4jMaven |
before 2.2.0-M01, plus listed versions 1.21.2.M011.2.M021.2.M031.2.M04 Show 45 moreShow less1.2.M051.2.M061.31.3.M011.3.M021.3.M031.3.M041.3.M051.41.4.11.4.21.4.M011.4.M021.4.M031.4.M041.4.M051.4.M061.51.5.11.5.21.5.31.5.M011.5.M021.61.6.11.6.21.6.31.6.M011.6.M021.6.M031.71.7.11.7.21.7.M011.7.M021.7.M031.81.8.11.8.21.8.31.8.M011.8.M021.8.M031.8.M041.8.M05 |
2.2.0-M01 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-7259 is a medium vulnerability (CVSS 6.8) in Neo4j, published April 29, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in org.neo4j:neo4j 2.2.0-M01.
References
Left out here: 46 versions. The JSON record has them.