CVE-2022-37423

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-08-12 · updated 2026-06-17
Weakness: CWE-22

Description

Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.log.stream.

Affected products

neo4j Awesome Procedures On Cypher: before 4.3.0.7; from 4.4.0.0 before 4.4.0.8 — fixed in 4.3.0.7, 4.4.0.8

How to fix

Upgrade to a fixed version: neo4j Awesome Procedures On Cypher 4.3.0.7, 4.4.0.8. Check the vendor advisory for mitigations.

References

https://github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-78f9-745f-278p
https://neo4j.com/docs/aura/platform/apoc/
https://github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-78f9-745f-278p
https://neo4j.com/docs/aura/platform/apoc/

Get alerted when CVE-2022-37423 or the next vulnerability affects your stack