{"id":"GHSA-pc4w-8v5j-29w9","summary":"Deserialization of Untrusted Data in Neo4j","details":"Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains.","aliases":["BIT-neo4j-2021-34371","BIT-neo4j-enterprise-2021-34371","CVE-2021-34371"],"modified":"2026-08-26T15:41:11.955326718Z","published":"2021-09-01T18:31:29Z","database_specific":{"nvd_published_at":"2021-08-05T20:15:00Z","cwe_ids":["CWE-502"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2021-08-30T21:46:09Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34371"},{"type":"PACKAGE","url":"https://github.com/neo4j/neo4j"},{"type":"WEB","url":"https://www.exploit-db.com/exploits/50170"}],"affected":[{"package":{"name":"org.neo4j:neo4j","ecosystem":"Maven","purl":"pkg:maven/org.neo4j/neo4j"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0"}]}],"versions":["1.2","1.2.M01","1.2.M02","1.2.M03","1.2.M04","1.2.M05","1.2.M06","1.3","1.3.M01","1.3.M02","1.3.M03","1.3.M04","1.3.M05","1.4","1.4.1","1.4.2","1.4.M01","1.4.M02","1.4.M03","1.4.M04","1.4.M05","1.4.M06","1.5","1.5.1","1.5.2","1.5.3","1.5.M01","1.5.M02","1.6","1.6.1","1.6.2","1.6.3","1.6.M01","1.6.M02","1.6.M03","1.7","1.7.1","1.7.2","1.7.M01","1.7.M02","1.7.M03","1.8","1.8.1","1.8.2","1.8.3","1.8.M01","1.8.M02","1.8.M03","1.8.M04","1.8.M05","1.8.M06","1.8.M07","1.8.RC1","1.9","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","1.9.8","1.9.9","1.9.M01","1.9.M02","1.9.M03","1.9.M04","1.9.M05","1.9.RC1","1.9.RC2","2.0.0","2.0.0-M01","2.0.0-M02","2.0.0-M03","2.0.0-M04","2.0.0-M05","2.0.0-M06","2.0.0-RC1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.1.0","2.1.0-M01","2.1.0-M02","2.1.0-RC1","2.1.0-RC2","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.2.0","2.2.0-M01","2.2.0-M02","2.2.0-M03","2.2.0-M04","2.2.0-RC01","2.2.1","2.2.10","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.3.0-M01","2.3.0-M02","2.3.0-M03","2.3.0-RC1","2.3.1","2.3.10","2.3.11","2.3.12","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","3.0.0","3.0.0-M01","3.0.0-M02","3.0.0-M03","3.0.0-M04","3.0.0-M05","3.0.0-RC1","3.0.1","3.0.10","3.0.11","3.0.12","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.0-BETA1","3.1.0-M01","3.1.0-M02","3.1.0-M03","3.1.0-M04","3.1.0-M05","3.1.0-M06","3.1.0-M07","3.1.0-M08","3.1.0-M09","3.1.0-M10","3.1.0-M12-beta2","3.1.0-M13-beta3","3.1.0-RC1","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0-alpha01","3.2.0-alpha02","3.2.0-alpha03","3.2.0-alpha04","3.2.0-alpha05","3.2.0-alpha06","3.2.0-alpha07","3.2.0-alpha08","3.2.0-rc1","3.2.0-rc2","3.2.0-rc3","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.14","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.3.0","3.3.0-alpha01","3.3.0-alpha02","3.3.0-alpha03","3.3.0-alpha04","3.3.0-alpha05","3.3.0-alpha06","3.3.0-alpha07","3.3.0-beta01","3.3.0-beta02","3.3.0-rc1","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7","3.3.8","3.3.9","3.4.0","3.4.0-alpha01","3.4.0-alpha02","3.4.0-alpha03","3.4.0-alpha04","3.4.0-alpha05","3.4.0-alpha06","3.4.0-alpha07","3.4.0-alpha08","3.4.0-alpha09","3.4.0-alpha10","3.4.0-beta01","3.4.0-beta02","3.4.0-rc01","3.4.0-rc02","3.4.1","3.4.10","3.4.11","3.4.12","3.4.13","3.4.14","3.4.15","3.4.16","3.4.17","3.4.18","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9","3.5.0-alpha01","3.5.0-alpha02","3.5.0-alpha03","3.5.0-alpha04","3.5.0-alpha05","3.5.0-alpha06","3.5.0-alpha07","3.5.0-alpha08","3.5.0-alpha09","3.5.0-beta01","3.5.0-beta02","3.5.0-beta03","3.5.0-rc01"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-pc4w-8v5j-29w9/GHSA-pc4w-8v5j-29w9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}