PT-2019-8645 · Apache · Apache Solr

Hrishikesh Gadre + 1 · Published 2019-07-03 · Updated 2019-07-11 · CVE-2017-9325

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Solr (affected versions not specified)

Description The issue arises from the provided secure solrconfig.xml sample configuration, which fails to enforce Sentry authorization on the "/update/json/docs" API endpoint. This lack of authorization can lead to unauthorized access and modifications.

Recommendations For all affected versions, consider modifying the solrconfig.xml to properly enforce Sentry authorization on the "/update/json/docs" API endpoint as a temporary workaround. Restrict access to this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2017-9325

Affected Products

Apache Solr

References · 4

• https://cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9325 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9325 · Vendor Advisory
• https://t.me/cibsecurity/5342 · Telegram Post