Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Apache Solr 8.8.2 Clear all filters
TI-2021-10560 CVE-2021-29943 · GHSA-vf7p-j8x6-xvwp

Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections

Priority MEDIUM 47

When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.04665 Published 2021-04-13 Partial fix · 8.8.2 CWE-863
TI-2021-10071 CVE-2021-29262 · GHSA-jgcr-fg3g-qvw8

Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings

Priority MEDIUM 42

When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06724 Published 2021-04-13 Partial fix · 8.8.2 CWE-522
TI-2021-09240 CVE-2021-27905 · GHSA-5phw-3jrp-3vj8

SSRF vulnerability with the Replication handler

Priority CRITICAL 86

The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr co…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.93053 Published 2021-04-13 Partial fix · 8.8.2 CWE-918