Lucene search

[email protected]CVE-2021-42767

HistoryMar 01, 2022 - 2:15 a.m.

CVE-2021-42767

2022-03-0102:15:07

CWE-22

[email protected]

web.nvd.nist.gov

102

cve-2021-42767

directory traversal

neo4j

graph database

security vulnerability

nvd

apoc plugins

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

8.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.7%

JSON

A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1.

Affected configurations

NVD

Node

neo4jawesome_proceduresRange<3.5.0.17neo4j

neo4jawesome_proceduresRange4.2.0.0–4.2.10neo4j

neo4jawesome_proceduresRange4.3.0.0–4.3.0.4neo4j

neo4jawesome_proceduresRange4.4.0.0–4.4.0.1neo4j

CPENameOperatorVersion
neo4j:awesome_proceduresneo4j awesome procedureslt3.5.0.17
neo4j:awesome_proceduresneo4j awesome procedureslt4.2.10
neo4j:awesome_proceduresneo4j awesome procedureslt4.3.0.4
neo4j:awesome_proceduresneo4j awesome procedureslt4.4.0.1

CPE	Name	Operator	Version
neo4j:awesome_procedures	neo4j awesome procedures	lt	3.5.0.17
neo4j:awesome_procedures	neo4j awesome procedures	lt	4.2.10
neo4j:awesome_procedures	neo4j awesome procedures	lt	4.3.0.4
neo4j:awesome_procedures	neo4j awesome procedures	lt	4.4.0.1

References

github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-4mpj-488r-vh6m

neo4j.com

Social References

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

8.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.7%

JSON

Related for CVE-2021-42767

osv2 veracode1 cvelist1 nvd1 prion1 github1