Read the docs
TI-2023-27507 Aliases CVE-2023-50298GHSA-xrj7-x7gp-wwqr

Apache Solr: Solr can expose ZooKeeper credentials via Streaming Expressions

Priority MEDIUM 42CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. Solr Streaming Expressions allows users to extract data from other Solr Clouds, using a "zkHost" parameter. When original SolrCloud is setup to use ZooKeeper credentials and ACLs, they will be sent to whatever "zkHost" the user provides. An attacker could setup a server to mock ZooKeeper, that accepts ZooKeeper requests with credentials and ACLs and extracts the sensitive information, then send a streaming expression using the mock server's address in "zkHost". Streaming Expressions are exposed via the "/streaming" handler, with "read" permissions. Users are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the issue. From these versions on, only zkHost values that have the same server address (regardless of chroot), will use the given ZooKeeper credentials and ACLs when connecting.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01564 75th percentileScored 2026-11-07
Fix Fixed Apache Solr (Apache Software Foundation): 9.4.1org.apache.solr:solr-solrj-streaming (Maven): 9.4.1, 8.11.3+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Solr6.0.0 – 8.11.2; 9.0.0 to before 9.4.19.4.1Patch availableCNA
—org.apache.solr:solr-solrj-streaming (Maven)9.0.0 to before 9.4.19.4.1Patch availableGHSA-xrj7-x7gp-wwqr
—org.apache.solr:solr-solrj-streaming (Maven)6.0.0 to before 8.11.38.11.3Patch availableGHSA-xrj7-x7gp-wwqr
—org.apache.solr:solr-solrj (Maven)9.0.0 to before 9.4.19.4.1Patch availableGHSA-xrj7-x7gp-wwqr
—org.apache.solr:solr-solrj (Maven)6.0.0 to before 8.11.38.11.3Patch availableGHSA-xrj7-x7gp-wwqr
  • Apache Solr VendorApache Affected 6.0.0 – 8.11.2; 9.0.0 to before 9.4.1 Fixed in 9.4.1 Patch available CNA
  • org.apache.solr:solr-solrj-streaming (Maven) Vendor— Affected 9.0.0 to before 9.4.1 Fixed in 9.4.1 Patch available GHSA-xrj7-x7gp-wwqr
  • org.apache.solr:solr-solrj-streaming (Maven) Vendor— Affected 6.0.0 to before 8.11.3 Fixed in 8.11.3 Patch available GHSA-xrj7-x7gp-wwqr
  • org.apache.solr:solr-solrj (Maven) Vendor— Affected 9.0.0 to before 9.4.1 Fixed in 9.4.1 Patch available GHSA-xrj7-x7gp-wwqr
  • org.apache.solr:solr-solrj (Maven) Vendor— Affected 6.0.0 to before 8.11.3 Fixed in 8.11.3 Patch available GHSA-xrj7-x7gp-wwqr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*6.0.0 to before 8.11.3; 9.0.0 to before 9.4.1VulnerableApache
  • cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* Versions 6.0.0 to before 8.11.3; 9.0.0 to before 9.4.1 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Solr (Apache Software Foundation) Fixed in 9.4.1
  • Fix · GHSA-xrj7-x7gp-wwqr org.apache.solr:solr-solrj-streaming (Maven) Fixed in 9.4.1 Advisory →
  • Fix · GHSA-xrj7-x7gp-wwqr org.apache.solr:solr-solrj-streaming (Maven) Fixed in 8.11.3 Advisory →
  • Fix · GHSA-xrj7-x7gp-wwqr org.apache.solr:solr-solrj (Maven) Fixed in 9.4.1 Advisory →
  • Fix · GHSA-xrj7-x7gp-wwqr org.apache.solr:solr-solrj (Maven) Fixed in 8.11.3 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Solr 9.4.1

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2023-27570 Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSetsPriority HIGH 81
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 5 products
  • Red Hat Data Grid 8
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-50298
  2. 2026-10-03 Alias added: GHSA-xrj7-x7gp-wwqr

References

Advisory 2

Other 6

  • TI-2024-30303 Apache Solr: Authentication bypass possible using a fake URL Path ending CVSS 3.1CRITICAL 9.8
  • TI-2019-13101 Injection in Apache Solr KEVCVSS 3.1HIGH 7.5
  • TI-2019-00170 Code injection in Apache Solr KEVCVSS 3.1HIGH 7.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2021-09240 SSRF vulnerability with the Replication handler CVSS 3.1CRITICAL 9.8
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences