Description

Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.log.stream.

Remediation

References

https://github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-78f9-745f-278p

https://neo4j.com/docs/aura/platform/apoc/

Related Vulnerabilities

CVE-2021-4264 Vulnerability in npm package dustjs-linkedin

CVE-2021-43849 Vulnerability in npm package cordova-plugin-fingerprint-aio

CVE-2020-7739 Vulnerability in npm package phantomjs-seo

CVE-2022-1295 Vulnerability in npm package fullpage.js

CVE-2020-26217 Vulnerability in maven package xstream:xstream

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Third Party Advisory Product Vendor Advisory CWE-22