CVE-2024-34517
Fixed in a distro release EPSS <1%CVSS 6.5
The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access.
Products: Neo4j
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.neo4j:neo4j-cypher | 5.19.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | neo4j | 5.20.0-r0 |
| Chainguard | neo4j-oci-entrypoint | 5.20.0-r0 |
| Wolfi | neo4j | 5.20.0-r0 |
| Wolfi | neo4j-oci-entrypoint | 5.20.0-r0 |