{"id":"CVE-2013-7259","aliases":["EUVD-2013-7037","GHSA-x626-q4v7-7xc6"],"status":"published","title":"Neo4J vulnerable to Cross-Site Request Forgery","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01253,"percentile":0.69621,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352","CWE-78"],"published":"2014-04-29T14:00:00Z","modified":"2026-06-17T00:01:36Z","fixes":[{"ecosystem":"Maven","package":"org.neo4j:neo4j","fixed_in":["2.2.0-M01"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.neo4j:neo4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-M01"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.neo4j:neo4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-M01"}]}],"versions":["1.2","1.2.M01","1.2.M02","1.2.M03","1.2.M04","1.2.M05","1.2.M06","1.3","1.3.M01","1.3.M02","1.3.M03","1.3.M04","1.3.M05","1.4","1.4.1","1.4.2","1.4.M01","1.4.M02","1.4.M03","1.4.M04","1.4.M05","1.4.M06","1.5","1.5.1","1.5.2","1.5.3","1.5.M01","1.5.M02","1.6","1.6.1","1.6.2","1.6.3","1.6.M01","1.6.M02","1.6.M03","1.7","1.7.1","1.7.2","1.7.M01","1.7.M02","1.7.M03","1.8","1.8.1","1.8.2","1.8.3","1.8.M01","1.8.M02","1.8.M03","1.8.M04","1.8.M05","1.8.M06","1.8.M07","1.8.RC1","1.9","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","1.9.8","1.9.9","1.9.M01","1.9.M02","1.9.M03","1.9.M04","1.9.M05","1.9.RC1","1.9.RC2","2.0.0","2.0.0-M01","2.0.0-M02","2.0.0-M03","2.0.0-M04","2.0.0-M05","2.0.0-M06","2.0.0-RC1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.1.0","2.1.0-M01","2.1.0-M02","2.1.0-RC1","2.1.0-RC2","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8"]}],"products":[{"vendor":"neo4j","product":"neo4j"}],"references":[{"url":"https://github.com/o2platform/DefCon_RESTing/tree/master/Live-Demos/Neo4j","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://blog.diniscruz.com/2013/08/neo4j-csrf-payload-to-start-processes.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2014/01/03/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/01/03/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7259","tags":["advisory"]},{"url":"https://github.com/neo4j/neo4j/issues/2826","tags":["web"]},{"url":"https://github.com/neo4j/neo4j/commit/40ad76078a25666d8b218772b6491fb443020df9","tags":["web"]},{"url":"https://web.archive.org/web/20131017043717/http://blog.diniscruz.com/2013/08/neo4j-csrf-payload-to-start-processes.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x626-q4v7-7xc6"},{"url":"https://github.com/neo4j/neo4j","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2013-7259","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.","status":"published","published":"2014-04-29T14:00:00Z","modified":"2024-08-06T18:01:19.791Z","updated_at":"2026-11-02T14:34:59.222149Z"}],"euvd":[{"id":"EUVD-2013-7037","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.","status":"published","published":"2014-04-29T14:00:00Z","modified":"2024-08-06T18:01:19Z","updated_at":"2026-11-03T01:56:23.942036Z"}],"ghsa":[{"id":"GHSA-x626-q4v7-7xc6","title":"Neo4J vulnerable to Cross-Site Request Forgery","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.","status":"published","published":"2022-05-17T04:38:50Z","modified":"2025-04-14T15:44:46Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-78","CWE-352"],"updated_at":"2026-11-02T14:38:39.85223Z"}],"nvd":[{"id":"CVE-2013-7259","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.","status":"published","published":"2014-04-29T14:38:47.797Z","modified":"2026-06-17T00:01:36.157Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-78","CWE-352"],"updated_at":"2026-11-02T14:02:50.049023Z"}],"osv":[{"id":"GHSA-x626-q4v7-7xc6","title":"Neo4J vulnerable to Cross-Site Request Forgery","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.","status":"published","published":"2022-05-17T04:38:50Z","modified":"2025-04-14T16:12:07.787603Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-352","CWE-78"],"updated_at":"2026-11-02T15:46:59.484835Z"}]}}