Read the docs
TI-2017-07183 Aliases CVE-2017-9803GHSA-f553-j2gv-g5r9

Improper authentication in Apache Solr

Priority LOW 37CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application. There are two issues with this functionality (when using SecurityAwareZkACLProvider type of ACL provider e.g. SaslZkACLProvider). Firstly, access to the security configuration can be leaked to users other than the solr super user. Secondly, malicious users can exploit this leaked configuration for privilege escalation to further expose/modify private data and/or disrupt operations in the Solr cluster. The vulnerability is fixed from Apache Solr 6.6.1 onwards.

Why it matters now

EPSS 0.02194 82nd percentileScored 2026-11-07
Fix Fixed org.apache.solr:solr-core (Maven): 6.6.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Solr6.2.0 to 6.6.0—No fix listedCNA
—org.apache.solr:solr-core (Maven)6.2.0 to before 6.6.16.6.1Patch availableGHSA-f553-j2gv-g5r9
  • Apache Solr VendorApache Affected 6.2.0 to 6.6.0 Fixed in — No fix listed CNA
  • org.apache.solr:solr-core (Maven) Vendor— Affected 6.2.0 to before 6.6.1 Fixed in 6.6.1 Patch available GHSA-f553-j2gv-g5r9

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:apache:solr:6.2.0:*:*:*:*:*:*:*6.2.0VulnerableApache
cpe:2.3:a:apache:solr:6.2.1:*:*:*:*:*:*:*6.2.1VulnerableApache
cpe:2.3:a:apache:solr:6.3.0:*:*:*:*:*:*:*6.3.0VulnerableApache
cpe:2.3:a:apache:solr:6.4.0:*:*:*:*:*:*:*6.4.0VulnerableApache
cpe:2.3:a:apache:solr:6.4.1:*:*:*:*:*:*:*6.4.1VulnerableApache
cpe:2.3:a:apache:solr:6.4.2:*:*:*:*:*:*:*6.4.2VulnerableApache
cpe:2.3:a:apache:solr:6.5.0:*:*:*:*:*:*:*6.5.0VulnerableApache
cpe:2.3:a:apache:solr:6.5.1:*:*:*:*:*:*:*6.5.1VulnerableApache
cpe:2.3:a:apache:solr:6.6.0:*:*:*:*:*:*:*6.6.0VulnerableApache
  • cpe:2.3:a:apache:solr:6.2.0:*:*:*:*:*:*:* Versions 6.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:6.2.1:*:*:*:*:*:*:* Versions 6.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:6.3.0:*:*:*:*:*:*:* Versions 6.3.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:6.4.1:*:*:*:*:*:*:* Versions 6.4.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:6.4.2:*:*:*:*:*:*:* Versions 6.4.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:6.5.0:*:*:*:*:*:*:* Versions 6.5.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:6.5.1:*:*:*:*:*:*:* Versions 6.5.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:6.6.0:*:*:*:*:*:*:* Versions 6.6.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-f553-j2gv-g5r9 org.apache.solr:solr-core (Maven) Fixed in 6.6.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 6 products
  • Red Hat JBoss Data Grid 6
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Fuse 6
  • Red Hat JBoss Fuse Service Works 6
  • Red Hat JBoss Portal 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-9803
  2. 2026-10-03 Alias added: GHSA-f553-j2gv-g5r9

References

Advisory 1

Other 3

  • TI-2024-30303 Apache Solr: Authentication bypass possible using a fake URL Path ending CVSS 3.1CRITICAL 9.8
  • TI-2019-13101 Injection in Apache Solr KEVCVSS 3.1HIGH 7.5
  • TI-2019-00170 Code injection in Apache Solr KEVCVSS 3.1HIGH 7.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2021-09240 SSRF vulnerability with the Replication handler CVSS 3.1CRITICAL 9.8
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences