Overview
- Description
- When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path traversal, leaving any file readable to the Solr server process exposed. Solr servers protected and restricted by firewall rules and/or authentication would not be at risk since only trusted clients and users would gain direct HTTP access.
- Source
- security@apache.org
- NVD status
- Modified
Risk scores
CVSS 3.0
- Type
- Primary
- Base score
- 7.5
- Impact score
- 3.6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 5
- Impact score
- 2.9
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
- nvd@nist.gov
- CWE-22
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C0CB118A-E405-41E5-B25F-C151B14292A7",
"versionEndIncluding": "5.5.3"
},
{
"criteria": "cpe:2.3:a:apache:solr:6.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "29F3170C-C5D6-431F-A2DD-692636CF5DAB"
},
{
"criteria": "cpe:2.3:a:apache:solr:6.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BA339070-A2BD-4559-B400-2BC2EB9923A7"
},
{
"criteria": "cpe:2.3:a:apache:solr:6.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B737CF14-C14A-4D97-B838-47EC4A2C68C8"
},
{
"criteria": "cpe:2.3:a:apache:solr:6.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "036F935D-B469-47C6-AF5D-3DFC73070753"
},
{
"criteria": "cpe:2.3:a:apache:solr:6.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "42A1A17A-32EA-40A2-9A1E-6019B493B5C1"
},
{
"criteria": "cpe:2.3:a:apache:solr:6.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "76557E9C-1F16-44D9-ACA1-F4DAEC966F05"
},
{
"criteria": "cpe:2.3:a:apache:solr:6.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DE068A02-D47A-4C6C-BFD3-040385599CA5"
}
],
"operator": "OR"
}
]
}
]