SCA: security update for org.neo4j.procedure:apoc (GHSA-5v8v-gwmw-qw97)

medium Tenable Self-Hosted Container Security Plugin ID 411025

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j that provides hundreds of procedures
and functions. A path traversal vulnerability found in the apoc.export.* procedures of apoc plugins in
Neo4j Graph database. The issue allows a malicious actor to potentially break out of the expected
directory. The vulnerability is such that files could only be created but not overwritten. For the
vulnerability to be exploited, an attacker would need access to execute an arbitrary query, either by
having access to an authenticated Neo4j client, or a Cypher injection vulnerability in an application. The
minimum versions containing patch for this vulnerability are 4.4.0.12 and 4.3.0.12 and 5.3.1. As a
workaround, you can control the allowlist of the procedures that can be used in your system, and/or turn
off local file access by setting apoc.export.file.enabled=false. (CVE-2022-23532)

Plugin Details

Severity: Medium

ID: 411025

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N

CVSS Score Source: CVE-2022-23532

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/13/2023

Vulnerability Publication Date: 1/13/2023

Reference Information

CVE: CVE-2022-23532

cwe: CWE-22

Detections

Analytics