PT-2021-18556 · Apache · Apache Solr

Geza Nagy · Published 2021-04-13 · Updated 2024-03-06 · CVE-2021-29943

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Solr versions prior to 8.8.2

Description The issue arises when using ConfigurableInternodeAuthHadoopPlugin for authentication. In this scenario, distributed requests are forwarded or proxied using server credentials instead of the original client credentials. This results in incorrect authorization resolution on the receiving hosts.

Recommendations For versions prior to 8.8.2, update to version 8.8.2 or later to resolve the issue. As a temporary workaround, consider disabling the use of ConfigurableInternodeAuthHadoopPlugin for authentication until a patch is available. Restrict access to distributed requests to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-SOLR-2021-29943

CVE-2021-29943

GHSA-VF7P-J8X6-XVWP

Affected Products

Apache Solr

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2021-29943 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-29943 · Security Note
• https://lists.apache.org/thread.html/r91dd0ff556e0c9aab4c92852e0e540c59d4633718ce12881558cf44d%40%3Cusers.solr.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/BIT-solr-2021-29943 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-29943 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29943 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vf7p-j8x6-xvwp · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-29943 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20210604-0009 · Note
• https://t.me/cvenotify/13462 · Telegram Post
• https://t.me/cvenotify/13143 · Telegram Post
• https://t.me/cvenotify/15827 · Telegram Post