Read the docs
TI-2017-02379 Aliases CVE-2017-3163GHSA-387v-84cv-9qmc

Path traversal in Apache Solr

Priority MEDIUM 42CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 4 fixed, 3 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path traversal, leaving any file readable to the Solr server process exposed. Solr servers protected and restricted by firewall rules and/or authentication would not be at risk since only trusted clients and users would gain direct HTTP access.

Why it matters now

EPSS 0.06559 93rd percentileScored 2026-11-07
Fix Partial org.apache.solr:solr-core (Maven): 5.5.4, 6.4.1Red Hat: 5 advisoriesRed Hat: 4 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Solr1.4.0 to 5.5.3; 6.0.0 to 6.4.0—No fix listedCNA
—org.apache.solr:solr-core (Maven)before 5.5.45.5.4Patch availableGHSA-387v-84cv-9qmc
—org.apache.solr:solr-core (Maven)6.0.0 to before 6.4.16.4.1Patch availableGHSA-387v-84cv-9qmc
  • Apache Solr VendorApache Affected 1.4.0 to 5.5.3; 6.0.0 to 6.4.0 Fixed in — No fix listed CNA
  • org.apache.solr:solr-core (Maven) Vendor— Affected before 5.5.4 Fixed in 5.5.4 Patch available GHSA-387v-84cv-9qmc
  • org.apache.solr:solr-core (Maven) Vendor— Affected 6.0.0 to before 6.4.1 Fixed in 6.4.1 Patch available GHSA-387v-84cv-9qmc

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*up to 5.5.3VulnerableApache
cpe:2.3:a:apache:solr:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableApache
cpe:2.3:a:apache:solr:6.0.1:*:*:*:*:*:*:*6.0.1VulnerableApache
cpe:2.3:a:apache:solr:6.1.0:*:*:*:*:*:*:*6.1.0VulnerableApache
cpe:2.3:a:apache:solr:6.2.0:*:*:*:*:*:*:*6.2.0VulnerableApache
cpe:2.3:a:apache:solr:6.2.1:*:*:*:*:*:*:*6.2.1VulnerableApache
cpe:2.3:a:apache:solr:6.3.0:*:*:*:*:*:*:*6.3.0VulnerableApache
cpe:2.3:a:apache:solr:6.4.0:*:*:*:*:*:*:*6.4.0VulnerableApache
  • cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* Versions up to 5.5.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:6.1.0:*:*:*:*:*:*:* Versions 6.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:6.2.0:*:*:*:*:*:*:* Versions 6.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:6.2.1:*:*:*:*:*:*:* Versions 6.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:6.3.0:*:*:*:*:*:*:* Versions 6.3.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-387v-84cv-9qmc org.apache.solr:solr-core (Maven) Fixed in 5.5.4 Advisory →
  • Fix · GHSA-387v-84cv-9qmc org.apache.solr:solr-core (Maven) Fixed in 6.4.1 Advisory →

Red Hat 5 advisories

  • RHSA-2018:1451 Released 2018-05-14 · Red Hat rating Important
    eap6-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-ec2-eap-7.5.20-1.Final_redhat_1.ep6.el6, jboss-ec2-eap-samples-7.5.20-1.Final_redhat_1.ep6.el6
  • RHSA-2018:1449 Released 2018-05-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.20 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server codehaus-jackson-1.9.9-12.redhat_6.1.ep6.el6, codehaus-jackson-core-asl-1.9.9-12.redhat_6.1.ep6.el6, codehaus-jackson-jaxrs-1.9.9-12.redhat_6.1.ep6.el6 +47
  • RHSA-2018:1450 Released 2018-05-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.20 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server codehaus-jackson-1.9.9-12.redhat_6.1.ep6.el5, codehaus-jackson-core-asl-1.9.9-12.redhat_6.1.ep6.el5, codehaus-jackson-jaxrs-1.9.9-12.redhat_6.1.ep6.el5 +47
Show 2 more Red Hat advisories
  • RHSA-2018:1448 Released 2018-05-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.20 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server codehaus-jackson-1.9.9-12.redhat_6.1.ep6.el7, codehaus-jackson-core-asl-1.9.9-12.redhat_6.1.ep6.el7, codehaus-jackson-jaxrs-1.9.9-12.redhat_6.1.ep6.el7 +47
  • RHSA-2018:1447 Released 2018-05-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.20 security update
    • Red Hat JBoss Enterprise Application Platform 6.4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Grid 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Will not fix
Red Hat JBoss Portal 6Affected—
Red Hat JBoss Enterprise Application Platform 6.4Fixed RHSA-2018:1447
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 ServerFixed RHSA-2018:1450
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2018:1449, RHSA-2018:1451
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2018:1448
Not affected: 2 products
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Fuse 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-3163
  2. 2026-10-03 Alias added: GHSA-387v-84cv-9qmc

References

Advisory 8

Other 2

  • TI-2024-30303 Apache Solr: Authentication bypass possible using a fake URL Path ending CVSS 3.1CRITICAL 9.8
  • TI-2019-13101 Injection in Apache Solr KEVCVSS 3.1HIGH 7.5
  • TI-2019-00170 Code injection in Apache Solr KEVCVSS 3.1HIGH 7.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2021-09240 SSRF vulnerability with the Replication handler CVSS 3.1CRITICAL 9.8
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences