GHSA-5phw-3jrp-3vj8

Source

https://github.com/advisories/GHSA-5phw-3jrp-3vj8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-5phw-3jrp-3vj8/GHSA-5phw-3jrp-3vj8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5phw-3jrp-3vj8

Aliases

Published

2021-05-10T15:18:06Z

Modified

2024-02-17T05:52:04.882037Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N CVSS Calculator

Summary

Server-Side Request Forgery in Apache Solr

Details

The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.

Database specific

{
    "nvd_published_at": "2021-04-13T07:15:00Z",
    "cwe_ids": [
        "CWE-918"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-14T15:52:41Z"
}

References

Affected packages

Maven / org.apache.solr:solr-parent

Package

Name: org.apache.solr:solr-parent; View open source insights on deps.dev
Purl: pkg:maven/org.apache.solr/solr-parent

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.8.2

Affected versions

1.*

1.3.0

1.4.0

1.4.1

3.*

3.1.0

3.2.0

3.3.0

3.4.0

3.5.0

3.6.0

3.6.1

3.6.2

4.*

4.0.0-ALPHA

4.0.0-BETA

4.0.0

4.1.0

4.2.0

4.2.1

4.3.0

4.3.1

4.4.0

4.5.0

4.5.1

4.6.0

4.6.1

4.7.0

4.7.1

4.7.2

4.8.0

4.8.1

4.9.0

4.9.1

4.10.0

4.10.1

4.10.2

4.10.3

4.10.4

5.*

5.0.0

5.1.0

5.2.0

5.2.1

5.3.0

5.3.1

5.3.2

5.4.0

5.4.1

5.5.0

5.5.1

5.5.2

5.5.3

5.5.4

5.5.5

6.*

6.0.0

6.0.1

6.1.0

6.2.0

6.2.1

6.3.0

6.4.0

6.4.1

6.4.2

6.5.0

6.5.1

6.6.0

6.6.1

6.6.2

6.6.3

6.6.4

6.6.5

6.6.6

7.*

7.0.0

7.0.1

7.1.0

7.2.0

7.2.1

7.3.0

7.3.1

7.4.0

7.5.0

7.6.0

7.7.0

7.7.1

7.7.2

7.7.3

8.*

8.0.0

8.1.0

8.1.1

8.2.0

8.3.0

8.3.1

8.4.0

8.4.1

8.5.0

8.5.1

8.5.2

8.6.0

8.6.1

8.6.2

8.6.3

8.7.0

8.8.0

8.8.1