CVE-2025-11602

{
  "id": "CVE-2025-11602",
  "sourceIdentifier": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6",
  "published": "2025-10-31T11:15:33.513",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous connections. The attacker has no control over the information leaked in server responses."
    },
    {
      "lang": "es",
      "value": "Posible fuga de información en el handshake del protocolo bolt en las ediciones Neo4j Enterprise y Community permite al atacante obtener un byte de información de conexiones anteriores. El atacante no tiene control sobre la información filtrada en las respuestas del servidor."
    }
  ],
  "affected": [
    {
      "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6",
      "affectedData": [
        {
          "vendor": "neo4j",
          "product": "Enterprise Edition",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "5.26.0",
              "lessThan": "5.26.15",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2025.1.0",
              "lessThan": "2025.10.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "neo4j",
          "product": "Community Edition",
          "defaultStatus": "unaffected",
          "collectionURL": "https://mvnrepository.com/artifact/org.neo4j/",
          "packageName": "neo4j",
          "repo": "https://github.com/neo4j/neo4j",
          "versions": [
            {
              "version": "5.26.0",
              "lessThan": "5.26.15",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2025.1.0",
              "lessThan": "2025.10.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:X/U:Clear",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "DIFFUSE",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "CLEAR"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-31T11:36:06.456339Z",
          "id": "CVE-2025-11602",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-226"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://neo4j.com/security/cve-2025-11602",
      "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"
    }
  ]
}