GitHub Advisoryadvisory · Maven

GHSA-pc4w-8v5j-29w9 Deserialization of Untrusted Data in Neo4j

CRITICAL Published 2021-09-01 Modified 2021-08-30 Official page ↗
Aliases
CVE-2021-34371
Ecosystem
Maven
Packages
org.neo4j:neo4j
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2021-08-30

Affected packages

• Maven org.neo4j:neo4j: < 3.5.0 → fixed in 3.5.0

Description

Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains.

Related

Alias · CVE (1)

  • CVE-2021-34371 Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References