Medium severity · published May 7, 2024
CVE-2024-34517
The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Neo4j · Neo4j
5.0.0 before 5.19 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-34517
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-34517
Third Party Advisory
https://github.com/advisories/GHSA-p343-9qwp-pqxv
Release Notes
https://github.com/neo4j/neo4j/wiki/Neo4j-5-changelog#cypher
Vendor Advisory
https://neo4j.com/security/cve-2024-34517/
Product
https://trust.neo4j.com
More from Neo4j
9.8
CVE-2026-1524
Auth misconfiguration when multiple providers enabled
9.8
CVE-2021-34371
Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable
9.8
CVE-2018-18389
Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization,…
7.5
CVE-2026-14587
Unathenticated connection can hold Bolt channel open
7.2
CVE-2026-1497
Incorrect privilege assignment in composite databases