CVE-2013-7259: CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/executescript or (2) db/manage/server/console/.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.neo4j:neo4jto a version that resolves this vulnerability.Fixed in 2.2.0-M01
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7259?
CVE-2013-7259 is considered to have a medium severity due to its potential to allow remote attackers to hijack administrator authentication for executing arbitrary code.
How do I fix CVE-2013-7259?
To mitigate CVE-2013-7259, upgrade to a version of Neo4j that is not vulnerable to CSRF vulnerabilities.
What kind of attacks can CVE-2013-7259 facilitate?
CVE-2013-7259 can facilitate cross-site request forgery (CSRF) attacks that allow the execution of arbitrary code on behalf of authenticated users.
Which software versions are affected by CVE-2013-7259?
CVE-2013-7259 specifically affects Neo4j version 1.9.2.
What are the implications of CVE-2013-7259 for administrators?
Administrators could face serious security risks including unauthorized access and execution of malicious commands due to this vulnerability.