Unscored severity · published Apr 29, 2014
CVE-2013-7259
Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Neo4j · Neo4j
1.9.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-7259
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-7259
blog.diniscruz.com
http://blog.diniscruz.com/2013/08/neo4j-csrf-payload-to-start-processes.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2014/01/03/3
www.openwall.com
http://www.openwall.com/lists/oss-security/2014/01/03/8
github.com
https://github.com/o2platform/DefCon_RESTing/tree/master/Live-Demos/Neo4j
More from Neo4j
9.8
CVE-2026-1524
Auth misconfiguration when multiple providers enabled
9.8
CVE-2021-34371
Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable
9.8
CVE-2018-18389
Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization,…
7.5
CVE-2026-14587
Unathenticated connection can hold Bolt channel open
7.2
CVE-2026-1497
Incorrect privilege assignment in composite databases