CVE-2021-42767

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Mar 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-42775.3A vulnerability, which was classified as problematic, has been found in fredsmith utils. This issue affects some unknown processing of the f CVE-2021-427706.1A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication test CVE-2021-427717.8Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory CVE-2021-427729.8Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mo CVE-2021-427737.5Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mo CVE-2021-427749.8Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mo CVE-2021-427759.1Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mo CVE-2021-427767.7CloverDX Server before 5.11.2 and and 5.12.x before 5.12.1 allows XXE during configuration import.CVE-2021-427779.8Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitrary C# code on any mac CVE-2021-427785.3A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo.CVE-2021-427795.3A heap use after free issue was found in Opensc before version 0.22.0 in sc_file_valid.CVE-2021-42787.8A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation lea