Read the docs
TI-2023-30835 Aliases GHSA-7crc-r3wg-cfgf

Json response for search reveals Solr credentials

Priority LOW 38CWE-200Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Information disclosure
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-200.

Summary

### Impact An error in Ibexa's Solr search engine results in potential exposure of Solr credentials. This is a critical vulnerability and all supported versions of the engine are affected. Those not using the Solr search engine are not affected. ### Patches The issue is fixed in all supported versions of ezsystems/ezplatform-solr-search-engine, see "Patched versions". An advisory is also published for ibexa/solr, please see that repository. Commit: https://github.com/ezsystems/ezplatform-solr-search-engine/commit/1005e02cc32ff15a705857fa56171528a83b9c3e ### Workarounds None. ### References https://developers.ibexa.co/security-advisories/ibexa-sa-2023-005-vulnerabilities-in-solr-search-and-file-downloads

Why it matters now

Fix Fixed ezsystems/ezplatform-solr-search-engine (Packagist): 3.3.15, 2.0.2, 1.7.12

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—ezsystems/ezplatform-solr-search-engine (Packagist)3.3.0 to before 3.3.153.3.15Patch availableGHSA-7crc-r3wg-cfgf
—ezsystems/ezplatform-solr-search-engine (Packagist)2.0.0 to before 2.0.22.0.2Patch availableGHSA-7crc-r3wg-cfgf
—ezsystems/ezplatform-solr-search-engine (Packagist)1.7.0 to before 1.7.121.7.12Patch availableGHSA-7crc-r3wg-cfgf
  • ezsystems/ezplatform-solr-search-engine (Packagist) Vendor— Affected 3.3.0 to before 3.3.15 Fixed in 3.3.15 Patch available GHSA-7crc-r3wg-cfgf
  • ezsystems/ezplatform-solr-search-engine (Packagist) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-7crc-r3wg-cfgf
  • ezsystems/ezplatform-solr-search-engine (Packagist) Vendor— Affected 1.7.0 to before 1.7.12 Fixed in 1.7.12 Patch available GHSA-7crc-r3wg-cfgf

Remediation

  • Fix · GHSA-7crc-r3wg-cfgf ezsystems/ezplatform-solr-search-engine (Packagist) Fixed in 3.3.15 Advisory →
  • Fix · GHSA-7crc-r3wg-cfgf ezsystems/ezplatform-solr-search-engine (Packagist) Fixed in 2.0.2 Advisory →
  • Fix · GHSA-7crc-r3wg-cfgf ezsystems/ezplatform-solr-search-engine (Packagist) Fixed in 1.7.12 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-7crc-r3wg-cfgf

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences