PT-2021-20660 · Neo4J · Neo4J Graph Database

Published 2021-07-27 · Updated 2022-05-24 · CVE-2021-34802

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Neo4j Graph Database versions 4.2 through 4.3

Description: A failure in resetting the security context in some transaction actions could allow authenticated users to execute commands with elevated privileges.

Recommendations: For Neo4j Graph Database versions 4.2 through 4.3, update to a version that includes the fix for this issue to prevent authenticated users from executing commands with elevated privileges.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2021-34802

GHSA-2W4H-F44W-968F

Affected Products

Neo4J Graph Database

References · 6

• https://osv.dev/vulnerability/CVE-2021-34802 · Vendor Advisory
• https://neo4j.com/developer/kb/neo4j-4-2-x-sec-vuln-fix · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34802 · Security Note
• https://osv.dev/vulnerability/GHSA-2w4h-f44w-968f · Vendor Advisory
• https://github.com/neo4j/neo4j · Note
• https://neo4j.com · Note