Vulnerability	Vulnerable Version
H Improper Neutralization of Special Elements in Data Query Logic Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the `Neo4jProducer.retrieveNodes` and `deleteNode` processes when JSON property names from the `CamelNeo4jMatchProperties` header are interpolated into the Cypher WHERE clause without validation. An attacker can execute arbitrary Cypher queries and read, modify, or delete any node or relationship in the Neo4j database by supplying specially crafted JSON key names. This is only exploitable if a route maps untrusted input into the `CamelNeo4jMatchProperties` map, such as by passing a request body as the match map or from a consumer that does not filter inbound Camel* headers, allowing an external sender to influence the header. How to fix Improper Neutralization of Special Elements in Data Query Logic? Upgrade `org.apache.camel:camel-neo4j` to version 4.14.8, 4.18.3, 4.21.0 or higher.	[4.10.0,4.14.8)[4.15.0,4.18.3)[4.19.0,4.21.0)

Improper Neutralization of Special Elements in Data Query Logic

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the Neo4jProducer.retrieveNodes and deleteNode processes when JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation. An attacker can execute arbitrary Cypher queries and read, modify, or delete any node or relationship in the Neo4j database by supplying specially crafted JSON key names. This is only exploitable if a route maps untrusted input into the CamelNeo4jMatchProperties map, such as by passing a request body as the match map or from a consumer that does not filter inbound Camel* headers, allowing an external sender to influence the header.

How to fix Improper Neutralization of Special Elements in Data Query Logic?

Upgrade org.apache.camel:camel-neo4j to version 4.14.8, 4.18.3, 4.21.0 or higher.

[4.10.0,4.14.8)[4.15.0,4.18.3)[4.19.0,4.21.0)

Go back to all versions of this package