GHSA-2467-h365-j7hm

Source

https://github.com/advisories/GHSA-2467-h365-j7hm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-2467-h365-j7hm/GHSA-2467-h365-j7hm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2467-h365-j7hm

Aliases

Published

2022-02-10T00:31:31Z

Modified

2023-12-06T01:00:12.851008Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Improper Input Validation in Apache Solr

Details

Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands backup, restore and deleteBackup. Each of these take a location parameter, which was not validated, i.e you could read/write to any location the solr user can access.

Database specific

{
    "nvd_published_at": "2020-08-17T13:15:00Z",
    "github_reviewed_at": "2021-04-14T18:01:06Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-20"
    ]
}

References

Affected packages

Maven / org.apache.solr:solr-parent

Package

Name: org.apache.solr:solr-parent; View open source insights on deps.dev
Purl: pkg:maven/org.apache.solr/solr-parent

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.6.0

Affected versions

1.*

1.3.0

1.4.0

1.4.1

3.*

3.1.0

3.2.0

3.3.0

3.4.0

3.5.0

3.6.0

3.6.1

3.6.2

4.*

4.0.0-ALPHA

4.0.0-BETA

4.0.0

4.1.0

4.2.0

4.2.1

4.3.0

4.3.1

4.4.0

4.5.0

4.5.1

4.6.0

4.6.1

4.7.0

4.7.1

4.7.2

4.8.0

4.8.1

4.9.0

4.9.1

4.10.0

4.10.1

4.10.2

4.10.3

4.10.4

5.*

5.0.0

5.1.0

5.2.0

5.2.1

5.3.0

5.3.1

5.3.2

5.4.0

5.4.1

5.5.0

5.5.1

5.5.2

5.5.3

5.5.4

5.5.5

6.*

6.0.0

6.0.1

6.1.0

6.2.0

6.2.1

6.3.0

6.4.0

6.4.1

6.4.2

6.5.0

6.5.1

6.6.0

6.6.1

6.6.2

6.6.3

6.6.4

6.6.5

6.6.6

7.*

7.0.0

7.0.1

7.1.0

7.2.0

7.2.1

7.3.0

7.3.1

7.4.0

7.5.0

7.6.0

7.7.0

7.7.1

7.7.2

7.7.3

8.*

8.0.0

8.1.0

8.1.1

8.2.0

8.3.0

8.3.1

8.4.0

8.4.1

8.5.0

8.5.1

8.5.2