GHSA-pccr-q7v9-5f27

Source

https://github.com/advisories/GHSA-pccr-q7v9-5f27

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-pccr-q7v9-5f27/GHSA-pccr-q7v9-5f27.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-pccr-q7v9-5f27

Aliases

Published

2022-01-06T21:32:35Z

Modified

2024-02-16T08:19:55.616303Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache Solr Improper Input Validation and Path Traversal

Details

An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows.

Database specific

{
    "nvd_published_at": "2021-12-23T09:15:00Z",
    "cwe_ids": [
        "CWE-20",
        "CWE-22",
        "CWE-40"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-05T17:54:06Z"
}

References

Affected packages

Maven / org.apache.solr:solr-parent

Package

Name: org.apache.solr:solr-parent; View open source insights on deps.dev
Purl: pkg:maven/org.apache.solr/solr-parent

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.11.1

Affected versions

1.*

1.3.0

1.4.0

1.4.1

3.*

3.1.0

3.2.0

3.3.0

3.4.0

3.5.0

3.6.0

3.6.1

3.6.2

4.*

4.0.0-ALPHA

4.0.0-BETA

4.0.0

4.1.0

4.2.0

4.2.1

4.3.0

4.3.1

4.4.0

4.5.0

4.5.1

4.6.0

4.6.1

4.7.0

4.7.1

4.7.2

4.8.0

4.8.1

4.9.0

4.9.1

4.10.0

4.10.1

4.10.2

4.10.3

4.10.4

5.*

5.0.0

5.1.0

5.2.0

5.2.1

5.3.0

5.3.1

5.3.2

5.4.0

5.4.1

5.5.0

5.5.1

5.5.2

5.5.3

5.5.4

5.5.5

6.*

6.0.0

6.0.1

6.1.0

6.2.0

6.2.1

6.3.0

6.4.0

6.4.1

6.4.2

6.5.0

6.5.1

6.6.0

6.6.1

6.6.2

6.6.3

6.6.4

6.6.5

6.6.6

7.*

7.0.0

7.0.1

7.1.0

7.2.0

7.2.1

7.3.0

7.3.1

7.4.0

7.5.0

7.6.0

7.7.0

7.7.1

7.7.2

7.7.3

8.*

8.0.0

8.1.0

8.1.1

8.2.0

8.3.0

8.3.1

8.4.0

8.4.1

8.5.0

8.5.1

8.5.2

8.6.0

8.6.1

8.6.2

8.6.3

8.7.0

8.8.0

8.8.1

8.8.2

8.9.0

8.10.0

8.10.1

8.11.0