Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-7hhe-e71j-muem
Vulnerability ID VCID-7hhe-e71j-muem
Aliases CVE-2013-7259
GHSA-x626-q4v7-7xc6
Summary Neo4J vulnerable to Cross-Site Request Forgery Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-352 Cross-Site Request Forgery (CSRF)
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2013-7259
cvssv4 8.9 https://github.com/neo4j/neo4j
generic_textual HIGH https://github.com/neo4j/neo4j
cvssv4 8.9 https://github.com/neo4j/neo4j/commit/40ad76078a25666d8b218772b6491fb443020df9
generic_textual HIGH https://github.com/neo4j/neo4j/commit/40ad76078a25666d8b218772b6491fb443020df9
cvssv4 8.9 https://github.com/neo4j/neo4j/issues/2826
generic_textual HIGH https://github.com/neo4j/neo4j/issues/2826
cvssv4 8.9 https://github.com/o2platform/DefCon_RESTing/tree/master/Live-Demos/Neo4j
generic_textual HIGH https://github.com/o2platform/DefCon_RESTing/tree/master/Live-Demos/Neo4j
cvssv4 8.9 https://nvd.nist.gov/vuln/detail/CVE-2013-7259
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2013-7259
cvssv4 8.9 https://web.archive.org/web/20131017043717/http://blog.diniscruz.com/2013/08/neo4j-csrf-payload-to-start-processes.html
generic_textual HIGH https://web.archive.org/web/20131017043717/http://blog.diniscruz.com/2013/08/neo4j-csrf-payload-to-start-processes.html
cvssv4 8.9 http://www.openwall.com/lists/oss-security/2014/01/03/3
generic_textual HIGH http://www.openwall.com/lists/oss-security/2014/01/03/3
cvssv4 8.9 http://www.openwall.com/lists/oss-security/2014/01/03/8
generic_textual HIGH http://www.openwall.com/lists/oss-security/2014/01/03/8
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2013-7259
https://github.com/neo4j/neo4j
https://github.com/neo4j/neo4j/commit/40ad76078a25666d8b218772b6491fb443020df9
https://github.com/neo4j/neo4j/issues/2826
https://github.com/o2platform/DefCon_RESTing/tree/master/Live-Demos/Neo4j
https://nvd.nist.gov/vuln/detail/CVE-2013-7259
https://web.archive.org/web/20131017043717/http://blog.diniscruz.com/2013/08/neo4j-csrf-payload-to-start-processes.html
http://www.openwall.com/lists/oss-security/2014/01/03/3
http://www.openwall.com/lists/oss-security/2014/01/03/8
GHSA-x626-q4v7-7xc6 https://github.com/advisories/GHSA-x626-q4v7-7xc6
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/neo4j/neo4j
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/neo4j/neo4j/commit/40ad76078a25666d8b218772b6491fb443020df9
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/neo4j/neo4j/issues/2826
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/o2platform/DefCon_RESTing/tree/master/Live-Demos/Neo4j
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://nvd.nist.gov/vuln/detail/CVE-2013-7259
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://web.archive.org/web/20131017043717/http://blog.diniscruz.com/2013/08/neo4j-csrf-payload-to-start-processes.html
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at http://www.openwall.com/lists/oss-security/2014/01/03/3
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at http://www.openwall.com/lists/oss-security/2014/01/03/8
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.50288
EPSS Score 0.00266
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T09:41:29.231673+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-x626-q4v7-7xc6/GHSA-x626-q4v7-7xc6.json 38.6.0