AIKIDO-2025-10071
apoc is vulnerable to Insertion of Sensitive Information into Log File
15
CVE Score
Low
Insertion of Sensitive Information into Log File
TL;DR
Affected versions of this package actively expose sensitive information in log files by improperly logging the JDBC password in query.log. This vulnerability allows for the unintentional disclosure of sensitive data, potentially leading to security risks such as unauthorized access or leakage of private information.
How do I fix this?
Upgrade the org.neo4j.procedure:apoc library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Package
Versions
3.2.0.4 - 4.4.0.34
Fixed in 4.4.0.355.0.0 - 5.25.0
Fixed in 5.26.0Background info
apoc is vulnerable to Insertion of Sensitive Information into Log File in versions 3.2.0.4 - 4.4.0.34 and 5.0.0 - 5.25.0.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.