Detections
Analytics

SCA: security update for org.neo4j.procedure:apoc-core (GHSA-6wxg-wh7f-rqpr)

high Tenable Self-Hosted Container Security Plugin ID 411683

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE)
 vulnerability found in the apoc.import.graphml procedure of APOC core plugin prior to version 5.5.0 and
 4.4.0.14 (4.4 branch) in Neo4j graph database. XML External Entity (XXE) injection occurs when the XML
 parser allows external entities to be resolved. The XML parser used by the apoc.import.graphml procedure
 was not configured in a secure way and therefore allowed this. External entities can be used to read local
 files, send HTTP requests, and perform denial-of-service attacks on the application. Abusing the XXE
 vulnerability enabled assessors to read local files remotely. Although with the level of privileges
 assessors had this was limited to one-line files. With the ability to write to the database, any file
 could have been read. Additionally, assessors noted, with local testing, the server could be crashed by
 passing in improperly formatted XML. The minimum version containing a patch for this vulnerability is
 5.5.0. Those who cannot upgrade the library can control the allowlist of the procedures that can be used
 in your system. (CVE-2023-23926)

See Also

https://github.com/advisories/GHSA-6wxg-wh7f-rqpr

Plugin Details

Severity: High

ID: 411683

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.37

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:C

CVSS Score Source: CVE-2023-23926

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/16/2023

Vulnerability Publication Date: 2/16/2023

Reference Information

CVE: CVE-2023-23926

cwe: CWE-611