GHSA-j346-h5wc-rw2m

Source

https://github.com/advisories/GHSA-j346-h5wc-rw2m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-j346-h5wc-rw2m/GHSA-j346-h5wc-rw2m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-j346-h5wc-rw2m

Aliases

CVE-2018-11802

Published

2022-02-09T23:19:26Z

Modified

2023-11-08T03:59:48.243495Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Incorrect Authorization in Apache Solr

Details

In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).

Database specific

{
    "nvd_published_at": "2020-04-01T22:15:00Z",
    "github_reviewed_at": "2021-04-14T18:11:26Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-863"
    ]
}

References

Affected packages

Maven / org.apache.solr:solr-parent

Package

Name: org.apache.solr:solr-parent; View open source insights on deps.dev
Purl: pkg:maven/org.apache.solr/solr-parent

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.7.0

Affected versions

1.*

1.3.0

1.4.0

1.4.1

3.*

3.1.0

3.2.0

3.3.0

3.4.0

3.5.0

3.6.0

3.6.1

3.6.2

4.*

4.0.0-ALPHA

4.0.0-BETA

4.0.0

4.1.0

4.2.0

4.2.1

4.3.0

4.3.1

4.4.0

4.5.0

4.5.1

4.6.0

4.6.1

4.7.0

4.7.1

4.7.2

4.8.0

4.8.1

4.9.0

4.9.1

4.10.0

4.10.1

4.10.2

4.10.3

4.10.4

5.*

5.0.0

5.1.0

5.2.0

5.2.1

5.3.0

5.3.1

5.3.2

5.4.0

5.4.1

5.5.0

5.5.1

5.5.2

5.5.3

5.5.4

5.5.5

6.*

6.0.0

6.0.1

6.1.0

6.2.0

6.2.1

6.3.0

6.4.0

6.4.1

6.4.2

6.5.0

6.5.1

6.6.0

6.6.1

6.6.2

6.6.3

6.6.4

6.6.5

6.6.6

7.*

7.0.0

7.0.1

7.1.0

7.2.0

7.2.1

7.3.0

7.3.1

7.4.0

7.5.0

7.6.0

Maven / org.apache.solr:solr-core