neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after commit 45bc09c.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HNeo4j Awesome Procedures On Cyper
APPNeo4Jall versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SSRFDoSXXE
CWE
Related vulnerabilities
CVE-2022-23532HIGH7.1same product
APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j that provides hundreds of procedures and fu...
CVE-2023-23926MEDIUM5.9same product
APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability...
CVE-2021-42767CRITICAL9.1PL ✓same vendor
Path traversal w pluginach APOC dla Neo4J Graph Database
CVE-2021-34371CRITICAL9.8PL ✓same vendor
RCE przez deserializację RMI w Neo4j (shell server)
CVE-2018-18389CRITICAL9.8PL ✓same vendor
Neo4j Enterprise: ominięcie uwierzytelnienia LDAP via STARTTLS (Auth Bypass)