CVE-2023-50291

highpriority · track · 31EPSS 0.033 · 88 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

3.28% (88th) EPSS

CVSS 7.5 · high

Is it mine?

19 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties that had "password" contained in the name. There are a number of sensitive system properties, such as "basicauth" and "aws.secretKey" do not contain "password", thus their values were published via the "/admin/info/properties" endpoint. This endpoint populates the list of System Properties on the home screen of the Solr Admin page, making the exposed credentials visible in the UI. This /admin/info/properties endpoint is protected under the "config-read" permission. Therefore, Solr Clouds with Authorization enabled will only be vulnerable through logged-in users that have the "config-read" permission. Users are recommended to upgrade to version 9.3.0 or 8.11.3, which fixes the issue. A single option now controls hiding Java system property for all endpoints, "-Dsolr.hiddenSysProps". By default all known sensitive properties are hidden (including "-Dbasicauth"), as well as any property with a name containing "secret" or "password". Users who cannot upgrade can also use the following Java system property to fix the issue: '-Dsolr.redaction.system.pattern=.*(password|secret|basicauth).*'

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.16.5mediumAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondaryexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · OSV

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-522USCWE-522USCWE-522US

affected products (19)

Products and version ranges known to be affected.

Apache Solr <8.11.3all versionscert_bundDE
Apache Solr <9.3.0all versionscert_bundDE
IBM Operational Decision Manager 8.10.xall versionscert_bundDEcpe:/a:ibm:operational_decision_manager:8.10.x
IBM Operational Decision Manager 8.11.xall versionscert_bundDEcpe:/a:ibm:operational_decision_manager:8.11.x
IBM Operational Decision Manager 8.12.xall versionscert_bundDEcpe:/a:ibm:operational_decision_manager:8.12.x
IBM QRadar SIEM <7.5.0 UP12all versionscert_bundDE
Apache Solr< 8.11.3cert_bundDE
Apache Solr< 9.3.0cert_bundDE
IBM QRadar SIEM< 7.5.0 UP12cert_bundDE
Apache Software Foundation Apache Solr≤ 6.0.0 ≤8.11.2enisa_euvdEU
Apache Software Foundation Apache Solr9.0.0 → 9.3.0enisa_euvdEU
Apache Software Foundation Solr6.0.0 → 8.11.2fstec_bduRU
Apache Software Foundation Solr9.0.0 → 9.3.0fstec_bduRU
apache solr6.0.0 → 8.11.3nvdUScpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*
apache solr9.0.0 → 9.3.0nvdUScpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*
Bitnami solr6.0.0 → 8.11.3osvUSpkg:bitnami/solr
Bitnami solr9.0.0 → 9.3.0osvUSpkg:bitnami/solr
Maven org.apache.solr:solr-core6.0.0 → 8.11.3osvUSpkg:maven/org.apache.solr/solr-core
Maven org.apache.solr:solr-core9.0.0 → 9.3.0osvUSpkg:maven/org.apache.solr/solr-core

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-0340Apache Solr: Mehrere SchwachstellenDeutsch2024-02-11csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Solr ausnutzen, um Informationen offenzulegen oder beliebigen Programmcode auszuführen.
GHSA-3hwc-rqwp-v36qApache Solr can leak certain passwords due to System Property redaction logic inconsistencies2024-02-09ghsa · osvUS
Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties that had "password" contained in the name. There are a number of sensitive system properties, such as "basicauth" and "aws.secretKey" do not contain "password", thus their values were published via the "/admin/info/properties" endpoint. This endpoint populates the list of System Properties on the home screen of the Solr Admin page, making the exposed credentials visible in the UI. This /admin/info/properties endpoint is protected under the "config-read" permission. Therefore, Solr Clouds with Authorization enabled will only be vulnerable through logged-in users that have the "config-read" permission. Users are recommended to upgrade to version 9.3.0 or 8.11.3, both of which fix the issue. A single option now controls hiding Java system property for all endpoints, "-Dsolr.hiddenSysProps". By default all known sensitive properties are hidden (including "-Dbasicauth"), as well as any property with a name containing "secret" or "password". Users who cannot upgrade can also use the following Java system property to fix the issue: `-Dsolr.redaction.system.pattern=.*(password|secret|basicauth).*`
BIT-solr-2023-50291Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords2024-03-06vendor · osvUS
Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties that had "password" contained in the name. There are a number of sensitive system properties, such as "basicauth" and "aws.secretKey" do not contain "password", thus their values were published via the "/admin/info/properties" endpoint. This endpoint populates the list of System Properties on the home screen of the Solr Admin page, making the exposed credentials visible in the UI. This /admin/info/properties endpoint is protected under the "config-read" permission. Therefore, Solr Clouds with Authorization enabled will only be vulnerable through logged-in users that have the "config-read" permission. Users are recommended to upgrade to version 9.3.0 or 8.11.3, which fixes the issue. A single option now controls hiding Java system property for all endpoints, "-Dsolr.hiddenSysProps". By default all known sensitive properties are hidden (including "-Dbasicauth"), as well as any property with a name containing "secret" or "password". Users who cannot upgrade can also use the following Java system property to fix the issue: '-Dsolr.redaction.system.pattern=.*(password|secret|basicauth).*'

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

published 2024-02-09modified 2026-06-17

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan