Read the docs
TI-2023-27502 Aliases CVE-2023-50290GHSA-gg7w-pw2r-x2cq

Apache Solr: Host environment variables are published via the Metrics API

Priority HIGH 66CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess. The Solr Metrics API is protected by the "metrics-read" permission. Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission. This issue affects Apache Solr: from 9.0.0 before 9.3.0. Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.68446 99th percentileScored 2026-11-07
Fix Fixed Apache Solr (Apache Software Foundation): 9.3.0org.apache.solr:solr-core (Maven): 9.3.0Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Solr9.0.0 to before 9.3.09.3.0Patch availableCNA
—org.apache.solr:solr-core (Maven)9.0.0 to before 9.3.09.3.0Patch availableGHSA-gg7w-pw2r-x2cq
  • Apache Solr VendorApache Affected 9.0.0 to before 9.3.0 Fixed in 9.3.0 Patch available CNA
  • org.apache.solr:solr-core (Maven) Vendor— Affected 9.0.0 to before 9.3.0 Fixed in 9.3.0 Patch available GHSA-gg7w-pw2r-x2cq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*9.0.0 to before 9.3.0VulnerableApache
  • cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* Versions 9.0.0 to before 9.3.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Solr (Apache Software Foundation) Fixed in 9.3.0
  • Fix · GHSA-gg7w-pw2r-x2cq org.apache.solr:solr-core (Maven) Fixed in 9.3.0 Advisory →

Red Hat 1 advisory

  • RHSA-2024:3354 Released 2024-05-23 · Red Hat rating Important
    Red Hat Fuse 7.13.0 release and security update
    • Red Hat Fuse 7.13.0

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7.13.0Fixed RHSA-2024:3354
Not affected: 6 products
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Fuse 6
  • Red Hat JBoss Fuse Service Works 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-50290
  2. 2026-10-03 Alias added: GHSA-gg7w-pw2r-x2cq

References

Advisory 2

Other 3

  • TI-2024-30303 Apache Solr: Authentication bypass possible using a fake URL Path ending CVSS 3.1CRITICAL 9.8
  • TI-2019-13101 Injection in Apache Solr KEVCVSS 3.1HIGH 7.5
  • TI-2019-00170 Code injection in Apache Solr KEVCVSS 3.1HIGH 7.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2021-09240 SSRF vulnerability with the Replication handler CVSS 3.1CRITICAL 9.8
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences