PT-2019-8645 · Apache · Apache Solr

Hrishikesh Gadre + 1 · Publicado 2019-07-03 · Atualizado 2019-07-11 · CVE-2017-9325

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Solr (affected versions not specified)

Description The issue arises from the provided secure solrconfig.xml sample configuration, which fails to enforce Sentry authorization on the "/update/json/docs" API endpoint. This lack of authorization can lead to unauthorized access and modifications.

Recommendations For all affected versions, consider modifying the solrconfig.xml to properly enforce Sentry authorization on the "/update/json/docs" API endpoint as a temporary workaround. Restrict access to this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

CVE-2017-9325

Produtos afetados

Apache Solr

Referências · 4

• https://cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html · Aviso do Fabricante
• https://t.me/cibsecurity/5342 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2017-9325 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-9325 · Aviso do Fabricante