GitHub Advisoryadvisory · Maven

GHSA-r2pp-x4mm-4999 XML External Entity (XXE) vulnerability in neo4j.procedure:apoc

CRITICAL Published 2018-12-20 Modified 2022-09-14 Official page ↗
Aliases
CVE-2018-1000820
Ecosystem
Maven
Packages
org.neo4j.procedure:apoc
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2020-06-16

Affected packages

• Maven org.neo4j.procedure:apoc: < 3.4.0.4 → fixed in 3.4.0.4

Description

neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after commit 45bc09c.

Related

Alias · CVE (1)

  • CVE-2018-1000820 neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References