Description

A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1.

Remediation

References

https://neo4j.com

https://github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-4mpj-488r-vh6m

Related Vulnerabilities

CVE-2021-36774 Vulnerability in maven package org.apache.kylin:kylin-core-common

CVE-2021-33900 Vulnerability in maven package org.apache.directory.studio:org.apache.directory.studio.parent

CVE-2022-39249 Vulnerability in npm package matrix-js-sdk

CVE-2023-34840 Vulnerability in npm package angular-ui-notification

CVE-2022-45064 Vulnerability in maven package org.apache.sling:org.apache.sling.engine

Severity

Critical

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Tags

Product Vendor Advisory Third Party Advisory