CVE-2024-34517

MediumCVSS 6.5/10Last modified Aug 28, 2026

Description

The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-471

Affected software

No affected versions have been published.

Timeline

Published
May 7, 2024
Last modified
Aug 28, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-345196.8Avantra Server 24.x before 24.0.7 and 24.1.x before 24.1.1 mishandles the security of dashboards, aka XAN-5367. If a user can create a dashbCVE-2024-345208.8An authorization bypass vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R_1_0_24_0, which allowsCVE-2024-345213.5A directory traversal vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R_1_0_24_0, which allows aCVE-2024-345237.5AChecker 1.5 allows remote attackers to read the contents of arbitrary files via the download.php path parameter by using Unauthenticated PaCVE-2024-345249.1In XLANG OpenAgents through fe73ac4, the allowed_file protection mechanism can be bypassed by using an incorrect file extension for the natuCVE-2024-345255.3FileCodeBox 2.0 stores a OneDrive password and AWS key in a cleartext env file.CVE-2024-345277.5spaces_plugin/app.py in SolidUI 0.4.0 has an unnecessary print statement for an OpenAI key. The printed string might be logged.CVE-2024-345287.7WordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter CVE-2024-345294.8Nebari through 2024.4.1 prints the temporary Keycloak root password.CVE-2024-345329.8A SQL injection vulnerability in Yvan Dotet PostgreSQL Query Deluxe module (aka query_deluxe) 17.x before 17.0.0.4 allows a remote attacker CVE-2024-345337.3A SQL injection vulnerability in ZI PT Solusi Usaha Mudah Analytic Data Query module (aka izi_data) 11.0 through 17.x before 17.0.3 allows aCVE-2024-345347.3A SQL injection vulnerability in Cybrosys Techno Solutions Text Commander module (aka text_commander) 16.0 through 16.0.1 allows a remote at