Read the docs
TI-2023-27503 Aliases CVE-2023-50291GHSA-3hwc-rqwp-v36q

Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords

Priority MEDIUM 45CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-522.

Summary

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties that had "password" contained in the name. There are a number of sensitive system properties, such as "basicauth" and "aws.secretKey" do not contain "password", thus their values were published via the "/admin/info/properties" endpoint. This endpoint populates the list of System Properties on the home screen of the Solr Admin page, making the exposed credentials visible in the UI. This /admin/info/properties endpoint is protected under the "config-read" permission. Therefore, Solr Clouds with Authorization enabled will only be vulnerable through logged-in users that have the "config-read" permission. Users are recommended to upgrade to version 9.3.0 or 8.11.3, which fixes the issue. A single option now controls hiding Java system property for all endpoints, "-Dsolr.hiddenSysProps". By default all known sensitive properties are hidden (including "-Dbasicauth"), as well as any property with a name containing "secret" or "password". Users who cannot upgrade can also use the following Java system property to fix the issue:   '-Dsolr.redaction.system.pattern=.*(password|secret|basicauth).*'

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03278 88th percentileScored 2026-11-07
Fix Partial Apache Solr (Apache Software Foundation): 9.3.0org.apache.solr:solr-core (Maven): 8.11.3, 9.3.0Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Solr6.0.0 – 8.11.2; 9.0.0 to before 9.3.09.3.0Patch availableCNA
—org.apache.solr:solr-core (Maven)6.0.0 to before 8.11.38.11.3Patch availableGHSA-3hwc-rqwp-v36q
—org.apache.solr:solr-core (Maven)9.0.0 to before 9.3.09.3.0Patch availableGHSA-3hwc-rqwp-v36q
  • Apache Solr VendorApache Affected 6.0.0 – 8.11.2; 9.0.0 to before 9.3.0 Fixed in 9.3.0 Patch available CNA
  • org.apache.solr:solr-core (Maven) Vendor— Affected 6.0.0 to before 8.11.3 Fixed in 8.11.3 Patch available GHSA-3hwc-rqwp-v36q
  • org.apache.solr:solr-core (Maven) Vendor— Affected 9.0.0 to before 9.3.0 Fixed in 9.3.0 Patch available GHSA-3hwc-rqwp-v36q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*6.0.0 to before 8.11.3; 9.0.0 to before 9.3.0VulnerableApache
  • cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* Versions 6.0.0 to before 8.11.3; 9.0.0 to before 9.3.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Solr (Apache Software Foundation) Fixed in 9.3.0
  • Fix · GHSA-3hwc-rqwp-v36q org.apache.solr:solr-core (Maven) Fixed in 8.11.3 Advisory →
  • Fix · GHSA-3hwc-rqwp-v36q org.apache.solr:solr-core (Maven) Fixed in 9.3.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Solr 9.3.0

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2023-27504 Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated usersPriority MEDIUM 44
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Not affected: 3 products
  • Red Hat Data Grid 8
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Enterprise Application Platform 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-50291
  2. 2026-10-03 Alias added: GHSA-3hwc-rqwp-v36q

References

Advisory 2

Other 5

  • TI-2024-30303 Apache Solr: Authentication bypass possible using a fake URL Path ending CVSS 3.1CRITICAL 9.8
  • TI-2019-13101 Injection in Apache Solr KEVCVSS 3.1HIGH 7.5
  • TI-2019-00170 Code injection in Apache Solr KEVCVSS 3.1HIGH 7.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2021-09240 SSRF vulnerability with the Replication handler CVSS 3.1CRITICAL 9.8
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences