CVE-2021-34802

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow authenticated users to execute commands with elevated privileges.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://neo4j.comProduct
https://neo4j.com/developer/kb/neo4j-4-2-x-sec-vuln-fix/Vendor Advisory
https://neo4j.comProduct
https://neo4j.com/developer/kb/neo4j-4-2-x-sec-vuln-fix/Vendor Advisory

Timeline

Published: Jul 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-348037.8TeamViewer before 14.7.48644 on Windows loads untrusted DLLs in certain situations.CVE-2021-348057.5An issue was discovered in FAUST iServer before 9.0.019.019.7. For each URL request, it accesses the corresponding .fau file on the operatin CVE-2021-348076.1An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an at CVE-2021-348085.3Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to acce CVE-2021-348098.8Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology D CVE-2021-34817.1A flaw was found in Qt. An out-of-bounds read vulnerability was found in QRadialFetchSimd in qt/qtbase/src/gui/painting/qdrawhelper_p.h in Q CVE-2021-348108.8Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated use CVE-2021-348114.3Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote CVE-2021-348127.5Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensit CVE-2021-348139.8Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is attempting to retrieve an Olm encrypted room CVE-2021-348147.5Proofpoint Spam Engine before 8.12.0-2106240000 has a Security Control Bypass.CVE-2021-348154.8CheckSec Canopy before 3.5.2 allows XSS attacks against the login page via the LOGIN_PAGE_DISCLAIMER parameter.