{"id":"CVE-2021-42767","details":"A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1.","aliases":["GHSA-4mpj-488r-vh6m"],"modified":"2026-07-09T10:01:21.072784Z","published":"2022-03-01T02:15:07.370Z","database_specific":{"unresolved_ranges":[{"vendor_product":"neo4j:awesome_procedures","cpes":["cpe:2.3:a:neo4j:awesome_procedures:*:*:*:*:*:neo4j:*:*"],"extracted_events":[{"introduced":"4.2.0.0"},{"fixed":"4.2.10"}],"source":"CPE_RANGE"}]},"references":[{"type":"ADVISORY","url":"https://github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-4mpj-488r-vh6m"},{"type":"ADVISORY","url":"https://neo4j.com"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/neo4j-contrib/neo4j-apoc-procedures","events":[{"introduced":"0"},{"fixed":"88902b4b31f258dc9a7371dd7287b13e48c5d46a"},{"introduced":"93927b89028f67503ce8593c1509db598d102165"},{"fixed":"52a0958220ed2998225bce4548636a037ed9d16a"},{"introduced":"1e6de8e88876b526f84b677e4e6859f6f5b27c95"},{"fixed":"adee61eeef8711c0f498f3e9762d542aa2f96d8c"}],"database_specific":{"cpe":"cpe:2.3:a:neo4j:awesome_procedures:*:*:*:*:*:neo4j:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.5.0.17"},{"introduced":"4.3.0.0"},{"fixed":"4.3.0.4"},{"introduced":"4.4.0.0"},{"fixed":"4.4.0.1"}],"source":"CPE_RANGE"}}],"versions":["3.5.0.16","3.5.0.15-fix","4.4.0.0","4.3.0.3","4.3.0.2","4.3.0.1","4.3.0.0","3.5.0.15","3.5.0.14","3.5.0.13","3.5.0.12","3.5.0.11","3.5.0.9","3.5.0.8","3.5.0.7","3.5.0.6","3.5.0.5","3.5.0.4","3.5.0.3","3.5.0.2","3.5.0.1","3.5.0.0","3.4.0.3","3.4.0.2","3.4.0.1","3.3.0.2","3.3.0.1","3.2.0.4","3.2.0.3","3.1.3.6","3.1.2.5","3.1.0.4","3.1.0.3","3.1.0.2","3.1.0.1","3.0.4.1","1.1.0","1.0.0","1.0.0-RC1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-42767.json","vanir_signatures_modified":"2026-07-09T10:01:21Z","vanir_signatures":[{"deprecated":false,"digest":{"length":891,"function_hash":"207802441921537204896901189403421172352"},"id":"CVE-2021-42767-1dfd6a10","signature_type":"Function","signature_version":"v1","source":"https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/52a0958220ed2998225bce4548636a037ed9d16a","target":{"function":"loadCsvForMetric","file":"full/src/main/java/apoc/metrics/Metrics.java"}},{"deprecated":false,"digest":{"function_hash":"148235860615581967438097351628586614164","length":158},"id":"CVE-2021-42767-6b23d2f3","signature_type":"Function","signature_version":"v1","source":"https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/52a0958220ed2998225bce4548636a037ed9d16a","target":{"file":"full/src/test/java/apoc/metrics/MetricsTest.java","function":"shouldListMetrics"}},{"id":"CVE-2021-42767-7a4dff55","signature_type":"Function","signature_version":"v1","source":"https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/52a0958220ed2998225bce4548636a037ed9d16a","target":{"file":"full/src/test/java/apoc/metrics/MetricsTest.java","function":"beforeAll"},"deprecated":false,"digest":{"function_hash":"182662720706030460458167050211698383750","length":776}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/52a0958220ed2998225bce4548636a037ed9d16a","target":{"file":"core/src/main/java/apoc/util/ApocUrlStreamHandlerFactory.java","function":"createURLStreamHandler"},"deprecated":false,"digest":{"function_hash":"281692202849863382705659314443838687303","length":103},"id":"CVE-2021-42767-81b2b801"},{"target":{"file":"core/src/main/java/apoc/util/ApocUrlStreamHandlerFactory.java"},"deprecated":false,"digest":{"line_hashes":["118724760598893317982475357391888250702","42787929835364742382331780057433172078","16470593785582350785397032901801234475"],"threshold":0.9},"id":"CVE-2021-42767-8598f591","signature_type":"Line","signature_version":"v1","source":"https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/52a0958220ed2998225bce4548636a037ed9d16a"},{"source":"https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/52a0958220ed2998225bce4548636a037ed9d16a","target":{"file":"full/src/main/java/apoc/metrics/Metrics.java"},"deprecated":false,"digest":{"line_hashes":["95193999362841661895289845896028243311","261693692348930040984612887687535111589","245119315153008729244130802157176054276","312228315934111725499004949396862767107"],"threshold":0.9},"id":"CVE-2021-42767-9882e414","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["326407374985357365592746360777064624085","197118873685740969565063317695628189996","112294612097618583592768992805148845109","164547746798137424238900755296927338998","126078213229550900351017173744347645068","135150134212647040508387277717315844543","332306860352394965052039383555502549879","162764096537427463671519790558088939497","221997739649930657196741760142003088791","55687417267536926984773132019460202768","289327744451055700867636982514277268897","151103724863842922547844729830969069402","115645540087760266184531019474230504491","168158000555892453138181644095029972025","169871252963711939556104895977598583812","76255239339210194307863618699059398263","50821939529835205129435492129792887666","114034237037236198280404289766811056715","125866287381025221960492068262448416556","298411769115905202885627970124493109980","254213154127773681350157233177394834828","184424694594279896009214389812614281830","46707607899408460326253782815611406143","317896526428701706407315656040695414705","250640465049932201846732307601903714749"],"threshold":0.9},"id":"CVE-2021-42767-cddbee72","signature_type":"Line","signature_version":"v1","source":"https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/52a0958220ed2998225bce4548636a037ed9d16a","target":{"file":"full/src/test/java/apoc/metrics/MetricsTest.java"}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}