~ / search / GHSA-r2pp-x4mm-4999

GHSA-r2pp-x4mm-4999

XML External Entity (XXE) vulnerability in neo4j.procedure:apoc

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-1000820

Packages

EcosystemPackageAffectedFixed in
Maven org.neo4j.procedure:apoc < 3.4.0.4 3.4.0.4

Details

As written in the advisory (Markdown source, shown as plain text).

neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after commit 45bc09c.

References

External links from the advisory. They lead to third-party sites.