PT-2017-19196 · Apache · Apache Solr

Published 2017-09-18 · Updated 2022-05-14 · CVE-2017-9803

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Solr versions prior to 6.6.1

Description The issue concerns Apache Solr's Kerberos plugin when using a SecurityAwareZkACLProvider type of ACL provider. This allows for the potential leakage of access to the security configuration to users other than the Solr super user. Furthermore, malicious users can exploit this leaked configuration for privilege escalation, which can lead to the exposure or modification of private data and disruption of operations in the Solr cluster.

Recommendations For versions prior to 6.6.1, update to Apache Solr 6.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the security configuration to minimize the risk of exploitation. Restrict access to the Kerberos plugin's delegation token functionality until the update is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-9803

GHSA-F553-J2GV-G5R9

Affected Products

Apache Solr

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2017-9803 · Security Note
• https://osv.dev/vulnerability/GHSA-f553-j2gv-g5r9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-9803 · Vendor Advisory
• https://issues.apache.org/jira/browse/SOLR-11184 · Note
• http://mail-archives.us.apache.org/mod_mbox/www-announce/201709.mbox/%3CCAOOKt53AOScg04zUh0%2BR_fcXD0C9s5mQ-OzdgYdnHz49u1KmXw%40mail.gmail.com%3E · Note
• https://lists.apache.org/thread/f4rbt657n9x4kb74k1txhcojof5dzol5 · Note
• http://securityfocus.com/bid/100870 · Note