There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Neo4j Enterprise and Community editions versions prior to 2026.01.3 and 5.26.21 are vulnerable to a
    potential information disclosure by a user who has ability to access the local log files. The
    "obfuscate_literals" option in the query logs does not redact error information, exposing unredacted data
    in the query log when a customer writes a query that fails. It can allow a user with legitimate access to
    the local log files to obtain information they are not authorised to see. If this user is also in a
    position to run queries and trigger errors, this vulnerability can potentially help them to infer
    information they are not authorised to see through their intended database access. We recommend upgrading
    to versions 2026.01.3 (or 5.26.21) where the issue is fixed, and reviewing query log files permissions to
    ensure restricted access. If your configuration had db.logs.query.obfuscate_literals enabled, and you wish
    the obfuscation to cover the error messages as well, you need to enable the new configuration setting
    db.logs.query.obfuscate_errors once you have upgraded Neo4j. (CVE-2026-1622)

根據其自我報告的版本號碼遠端主機上執行的 Neo4j 版本是比 5.26.21舊的版本。因此受到一個資訊洩漏弱點影響其中查詢記錄中的 obfuscate_literals 選項不會編輯錯誤資訊進而在客戶寫入失敗的查詢時暴露查詢記錄中未編輯的資料。可合法存取本機記錄檔的使用者可藉以取得其未獲授權查看的資訊。
    請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼

根据其自我报告的版本号远程主机上运行的 Neo4j 版本低于 5.26.21。因查询日志中的 obfuscate_literals 选项未编辑错误信息而受到信息泄露漏洞的影响从而当客户写入失败的查询时会暴露查询日志中未编辑的数据。它可允许对本地日志文件具有合法访问权限的用户获取无权查看的信息。
    请注意，Nessus 并未测试这些问题，而是只依赖于应用程序自我报告的版本号

自己報告されたバージョン番号によると、リモートホストで実行されているNeo4jのバージョンは、 5.26.21より前です。したがって、クエリログのobfuscate_literalsオプションがエラー情報を修正せず、顧客が失敗したクエリを書き込んだときにクエリログの修正されていないデータを漏えいさせる情報漏えいの脆弱性の影響を受けます。これにより、ローカルログファイルに正当にアクセスできるユーザーが、表示権限のない情報を取得できる可能性があります。
    Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

According to its self-reported version number, the version of Neo4j running on the remote host is a version prior to 5.26.21. It is, therefore, affected by a information disclosure vulnerability where The obfuscate_literals option in the query logs does not redact error information, exposing unredacted data in the query log when a customer writes a query that fails. It can allow a user with legitimate access to the local log files to obtain information they are not authorised to see.
    Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number

ID	名稱	產品	系列	已發布	已更新	嚴重性
437545	SCA: security update for org.neo4j:neo4j (GHSA-4j3g-rwwq-4p54)	Tenable Self-Hosted Container Security	SCA Checks	2026/2/5	2026/7/2	medium
437545	SCA: security update for org.neo4j:neo4j (GHSA-4j3g-rwwq-4p54)	Tenable Cloud Security	SCA Checks	2026/2/5	2026/7/2	medium
298972	Neo4j < 5.26.21 資訊洩漏弱點 (CVE-2026-1622)	Nessus	CGI abuses	2026/2/13	2026/2/16	medium
298972	Neo4j < 5.26.21 信息泄露漏洞 (CVE-2026-1622)	Nessus	CGI abuses	2026/2/13	2026/2/16	medium
298972	Neo4j < 5.26.21 情報漏洩の脆弱性CVE-2026-1622	Nessus	CGI abuses	2026/2/13	2026/2/16	medium
298972	Neo4j < 5.26.21 Information Disclosure Vulnerability (CVE-2026-1622)	Nessus	CGI abuses	2026/2/13	2026/2/16	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium