CVE-2022-37423

2022-08-1215:15:16

CWE-22

[email protected]

web.nvd.nist.gov

neo4j

apoc

directory traversal

cve-2022-37423

security

vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

60.1%

JSON

Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.log.stream.

Affected configurations

NVD

Node

neo4jawesome_procedures_on_cypherRange<4.3.0.7

neo4jawesome_procedures_on_cypherRange4.4.0.0–4.4.0.8

CPENameOperatorVersion
neo4j:awesome_procedures_on_cypherneo4j awesome procedures on cypherlt4.3.0.7
neo4j:awesome_procedures_on_cypherneo4j awesome procedures on cypherlt4.4.0.8

CPE	Name	Operator	Version
neo4j:awesome_procedures_on_cypher	neo4j awesome procedures on cypher	lt	4.3.0.7
neo4j:awesome_procedures_on_cypher	neo4j awesome procedures on cypher	lt	4.4.0.8