APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin prior to version 5.5.0 and 4.4.0.14 (4.4 branch) in Neo4j graph database. XML External Entity (XXE) injection occurs when the XML parser allows external entities to be resolved. The XML parser used by the apoc.import.graphml procedure was not configured in a secure way and therefore allowed this. External entities can be used to read local files, send HTTP requests, and perform denial-of-service attacks on the application. Abusing the XXE vulnerability enabled assessors to read local files remotely. Although with the level of privileges assessors had this was limited to one-line files. With the ability to write to the database, any file could have been read. Additionally, assessors noted, with local testing, the server could be crashed by passing in improperly formatted XML. The minimum version containing a patch for this vulnerability is 5.5.0. Those who cannot upgrade the library can control the allowlist of the procedures that can be used in your system.
Published 2023-02-16 16:15:13
Updated 2023-04-14 21:15:08
Source GitHub, Inc.
View at NVD,   CVE.org
Vulnerability category: XML external entity (XXE) injectionDenial of service

Exploit prediction scoring system (EPSS) score for CVE-2023-23926

0.19%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 55 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-23926

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
8.1
HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
2.8
5.2
NIST
5.9
MEDIUM CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
1.6
4.2
GitHub, Inc.

CWE ids for CVE-2023-23926

  • The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
    Assigned by:
    • nvd@nist.gov (Secondary)
    • security-advisories@github.com (Primary)

References for CVE-2023-23926

Products affected by CVE-2023-23926

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!