BIT-solr-2021-29943

vendorUSosv

Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections

view advisory published 2024-03-06Licence: per source

When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-29943US	critical9.1OT elevated	4.67% (92nd)	—	2021-04-13
When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead o…

references

External citations — patches, advisories, analysis.

https://lists.apache.org/thread.html/r91dd0ff556e0c9aab4c92852e0e540c59d4633718ce12881558cf44d%40%3Cusers.solr.apache.org%3EADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2021-29943WEB
https://security.netapp.com/advisory/ntap-20210604-0009/ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan