Adam Reziouk

**Name of the Vulnerable Software and Affected Versions** APOC versions prior to 4.4.0.12 APOC versions prior to 4.3.0.12 APOC versions prior to 5.3.1 **Description** A path traversal issue found in the apoc.export.* procedures of apoc plugins in Neo4j Graph database allows a malicious actor to potentially break out of the expected directory. The issue is such that files could only be created but not overwritten. For the issue to be exploited, an attacker would need access to execute an arbitrary query, either by having access to an authenticated Neo4j client, or a Cypher injection vulnerability in an application. The procedure would need to have been allow listed in the neo4j configuration as well as having the apoc config `apoc.export.file.enabled` set to true. **Recommendations** For versions prior to 4.4.0.12, update to version 4.4.0.12 or later. For versions prior to 4.3.0.12, update to version 4.3.0.12 or later. For versions prior to 5.3.1, update to version 5.3.1 or later. As a temporary workaround, consider controlling the allowlist of procedures that can be used in your system, and/or turn off local file access by setting `apoc.export.file.enabled` to false.

**Name of the Vulnerable Software and Affected Versions** Oracle Java SE versions 8u361, 8u361-perf, 11.0.18, 17.0.6, 20 Oracle GraalVM Enterprise Edition versions 20.3.9, 21.3.5, 22.3.1 **Description** The issue allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE and Oracle GraalVM Enterprise Edition. Successful attacks can result in unauthorized update, insert, or delete access to some accessible data. This applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security. The vulnerability can also be exploited by using APIs in the specified component, for example, through a web service that supplies data to the APIs. **Recommendations** For Oracle Java SE versions 8u361, 8u361-perf, 11.0.18, 17.0.6, 20, and Oracle GraalVM Enterprise Edition versions 20.3.9, 21.3.5, 22.3.1, consider disabling the use of APIs in the Libraries component as a temporary workaround until a patch is available. Restrict access to the Libraries component to minimize the risk of exploitation. Avoid using the affected Oracle Java SE and Oracle GraalVM Enterprise Edition versions until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.