CVE-2025-12738 - CVE House
Back to Database
Status published Low CVE-2025-12738

Enumeration of restricted property value

Vulnerability Description

Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate access to the database. The vulnerability allows attacker without read access to a property to infer information about its value by trying to enumerate all possible values through observing error messages of SET property. We recommend upgrading to 2025.11.2 or 5.26.17 and above, where the issues is fixed.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-12738

Credits & Attribution

No credits recorded in the NVD database.

References

More from neo4j

View All →
CVE-2025-11602
Untargeted information leak in Bolt protocol handshake
Medium 6.3
CVE-2025-10193
Neo4j Cypher MCP server is vulnerable to DNS rebinding attacks
High 7.4
CVE-2023-23926
APOC (Awesome Procedures on Cypher) is an add-on library for...
Medium 5.9
CVE-2022-37423
Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x...
High 7.5
CVE-2021-42767
A directory traversal vulnerability in the apoc plugins in Neo4J...
Critical 9.1

Affected Vendor

Affected Software

Enterprise Edition
Vulnerable Versions:
0

Timeline

Official Publish: January 22nd, 2026
Last Modified: January 22nd, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration