CVE-2017-9803

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-9803
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-9803.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-9803
Aliases
Published
2017-09-18T21:29:00.280Z
Modified
2026-04-10T04:02:44.683440Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application. There are two issues with this functionality (when using SecurityAwareZkACLProvider type of ACL provider e.g. SaslZkACLProvider). Firstly, access to the security configuration can be leaked to users other than the solr super user. Secondly, malicious users can exploit this leaked configuration for privilege escalation to further expose/modify private data and/or disrupt operations in the Solr cluster. The vulnerability is fixed from Apache Solr 6.6.1 onwards.

References

Affected packages

Git / github.com/apache/lucene-solr

Affected ranges

Type
GIT
Repo
https://github.com/apache/lucene-solr
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
764d0f19151dbff6f5fcd9fc4b2682cf934590c5
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
43ab70147eb494324a1410f7a9f16a896a59bc6f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a66a44513ee8191e25b477372094bfa846450316
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
bbe4b08cc1fb673d0c3eb4b8455f23ddc1364124
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
72f75b2503fa0aa4f0aff76d439874feb923bb0e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
34a975ca3d4bd7fa121340e5bcbf165929e0542f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4b16c9a10c3c00cafaf1fc92ec3276a7bc7b8c95
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
cd1f23c63abe03ae650c75ec8ccb37762806cc75
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5c7a7b65d2aa7ce5ec96458315c661a18b320241
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.2.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.2.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.3.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.4.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.4.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.4.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.5.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.5.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.6.0"
        }
    ]
}

Affected versions

Other
grafts/lucene-oldest
grafts/lucene-solr-copy
grafts/lucene-solr-oldest-merged
history/branches/lucene-solr/lucene-6997
releases/lucene-solr/6.*
releases/lucene-solr/6.2.0
releases/lucene-solr/6.2.1
releases/lucene-solr/6.3.0
releases/lucene-solr/6.4.0
releases/lucene-solr/6.4.1
releases/lucene-solr/6.4.2
releases/lucene-solr/6.5.0
releases/lucene-solr/6.5.1
releases/lucene-solr/6.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-9803.json"