GitHub Advisoryadvisory · Maven

GHSA-p343-9qwp-pqxv Neo4j Cypher component mishandles IMMUTABLE privileges

MEDIUM Published 2024-05-07 Modified 2025-03-25 Official page ↗
Aliases
CVE-2024-34517
Ecosystem
Maven
Packages
org.neo4j:neo4j-cypher
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-269, CWE-471
Reviewed
2024-05-07

Affected packages

• Maven org.neo4j:neo4j-cypher: >= 5.0.0, < 5.19.0 → fixed in 5.19.0

Description

The Cypher component in Neo4j between v.5.0.0 and v.5.19.0 mishandles IMMUTABLE.

Related

Alias · CVE (1)

  • CVE-2024-34517 The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin… vulnerability

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-471 Modification of Assumed-Immutable Data (MAID) weakness

References