Apache Solr Schema Designer blindly "trusts" all configsets

🗓️ 09 Feb 2024 18:31:07Reported by GitHub Advisory DatabaseType

Apache Solr Schema Designer allows non-authenticated users to perform Remote Code Execution due to "trust" blind spo

Reporter	Title	Published	Views	Family All 19
Circl	CVE-2023-50292	9 Feb 202419:26	–	circl
CNNVD	Apache Solr Security Vulnerability	9 Feb 202400:00	–	cnnvd
CVE	CVE-2023-50292	9 Feb 202417:29	–	cve
Cvelist	CVE-2023-50292 Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users	9 Feb 202417:29	–	cvelist
IBM Security Bulletins	Security Bulletin: Multiple Apache Solr Vulerabilities Affect IBM OpenPages	19 Aug 202418:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for March 2024 - Multiple CVEs addressed	9 Apr 202416:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Apache Solr (lucene) affects IBM Operations Analytics - Log Analysis (CVE-2023-50386, CVE-2023-50298, CVE-2023-50292, CVE-2023-50291)	14 Apr 202508:13	–	ibm
Debian CVE	CVE-2023-50292	9 Feb 202417:29	–	debiancve
NVD	CVE-2023-50292	9 Feb 202418:15	–	nvd
OSV	BIT-SOLR-2023-50292 Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users	6 Mar 202411:05	–	osv

Vulners

Node

org.apache.solr solr-coreRange8.10.0–8.11.3maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-50292
solr	www.solr.apache.org/security.html
github	www.github.com/apache/lucene-solr/commit/6e9ed203b30958396bdfd41760d426b386646865
github	www.github.com/apache/solr/commit/d07751cfaa8065bea8bd43f59e758e50d50c2419
issues	www.issues.apache.org/jira/browse/SOLR-16777
openwall	www.openwall.com/lists/oss-security/2024/02/09/3
github	www.github.com/advisories/GHSA-4wxw-42wx-2wfx

09 Feb 2024 22:16Current

7.6High risk

Vulners AI Score7.6

CVSS 3.17.5

EPSS0.46454

SSVC