CVE-2021-34371

Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.exploit-db.com/exploits/50170	Exploit Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:neo4j:neo4j:*:*:*:*:community:*:*:*

History

12 Aug 2021, 17:44

Type	Values Removed	Values Added
CWE		CWE-502
References	~~(MISC) https://www.exploit-db.com/exploits/50170 -~~	(MISC) https://www.exploit-db.com/exploits/50170 - Exploit, Third Party Advisory, VDB Entry
CPE		cpe:2.3:a:neo4j:neo4j:::::community:::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 7.5 v3 : 9.8

05 Aug 2021, 20:39

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-08-05 20:15

Updated : 2024-02-04 21:47

NVD link : CVE-2021-34371

Mitre link : CVE-2021-34371

CVE.ORG link : CVE-2021-34371

JSON object : View

Products Affected

neo4j

neo4j

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2021-34371", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-08-05T20:15:09.280", "references": [{"url": "https://www.exploit-db.com/exploits/50170", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains."}, {"lang": "es", "value": "Neo4j versiones hasta 3.4.18 (con el servidor shell habilitado) expone un servicio RMI que deserializa arbitrariamente objetos Java, por ejemplo, mediante la funci\u00f3n setSessionVariable. Un atacante puede abusar de esto para una ejecuci\u00f3n de c\u00f3digo remota porque se presenta dependencias con cadenas de gadgets explotables"}], "lastModified": "2021-08-12T17:44:57.840", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:neo4j:neo4j:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "72E068B8-703E-4F65-8C1C-3EA194F19A11", "versionEndIncluding": "3.4.18"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}