CVE-2018-1000820: XEE

Published Dec 20, 2018

Updated

neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after commit 45bc09c.

Affected Software

1 affected component

Neo4j Awesome Procedures On Cyper

Remediation

Patch Available

https://github.com/neo4j-contrib/neo4j-apoc-procedures/issues/931

Event History

Dec 20, 2018

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-1000820?

CVE-2018-1000820 is classified as a high severity vulnerability due to its potential for data disclosure and denial of service.

How do I fix CVE-2018-1000820?

To fix CVE-2018-1000820, upgrade to a version of neo4j-apoc-procedures after commit 45bc09c.

What type of vulnerability is CVE-2018-1000820?

CVE-2018-1000820 is an XML External Entity (XXE) vulnerability.

What can be the consequences of CVE-2018-1000820?

The consequences of CVE-2018-1000820 can include disclosure of confidential data, denial of service, and server-side request forgery (SSRF).

Which versions of neo4j are affected by CVE-2018-1000820?

CVE-2018-1000820 affects versions of neo4j-apoc-procedures before commit 45bc09c.