What is GHSA-pc4w-8v5j-29w9?

GHSA-pc4w-8v5j-29w9 is a security advisory published by GitHub Security Advisories with Critical severity. Deserialization of Untrusted Data in Neo4j

Which CVE IDs does GHSA-pc4w-8v5j-29w9 cover?

GHSA-pc4w-8v5j-29w9 covers the following CVE IDs: CVE-2021-34371. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pc4w-8v5j-29w9?

GHSA-pc4w-8v5j-29w9 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-pc4w-8v5j-29w9?

GHSA-pc4w-8v5j-29w9 affects 1 product, including: maven/org.neo4j:neo4j:\u003c 3.5.0.

GHSA-pc4w-8v5j-29w9CriticalCVSS 9.8

Deserialization of Untrusted Data in Neo4j

Vendor

GitHub Security Advisories

Published

September 1, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-34371 →

📋 Description

Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains.

🎯 Affected products1

maven/org.neo4j:neo4j:< 3.5.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2021-34371
https://www.exploit-db.com/exploits/50170
https://github.com/advisories/GHSA-pc4w-8v5j-29w9