Description

A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1.

Remediation

References

https://github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-4mpj-488r-vh6m

https://neo4j.com

Related Vulnerabilities

CVE-2021-26540 Vulnerability in maven package org.webjars.npm:sanitize-html

CVE-2017-16152 Vulnerability in npm package static-html-server

CVE-2019-1003060 Vulnerability in maven package org.jenkins-ci.plugins:zap

CVE-2016-10698 Vulnerability in npm package mystem-fix

CVE-2023-26136 Vulnerability in maven package org.webjars.npm:tough-cookie

Severity

Critical

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Tags

Third Party Advisory Product Vendor Advisory