CVE-2021-29262

CVE-2021-29262 affects Apache Solr

CVE-2021-29262

When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be...

CVE-2021-27905

CVE-2021-27905 (Solr SSRF) affects Apache Solr versions prior to 8.8.2 where the ReplicationHandler’s masterUrl/leaderUrl parameter can be abused to trigger SSRF. The flaw arises because masterUrl is not sufficiently validated against allowed hosts/schemes, enabling an attacker to cause the serve...

CVE-2021-27905 SSRF vulnerability with the Replication handler

The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability,...

CVE-2021-27905

The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability,...

Apache Solr 安全漏洞

Apache Solr is a standalone enterprise-class search application server. Apache Solr information disclosure vulnerability can be exploited by an attacker to gain unauthorized access to server authentication and authorization profiles...

Apache Solr Unauthorized Access Vulnerability

Apache Solr is a standalone enterprise-class search application server. Apache Solr unauthorized access vulnerability allows an unauthorized attacker to exploit server-side misparsing to enable reading and writing of datasets...

Apache Solr 代码问题漏洞

Apache Solr is a standalone enterprise-class search application server. The Apache Solr server-side request forgery vulnerability can be exploited by an attacker to gain access to an intranet by constructing a request containing a malicious URL...

Apache Solr Information Disclosure Vulnerability

Apache Solr is a standalone enterprise-class search application server. Apache Solr information disclosure vulnerability can be exploited by an attacker to gain unauthorized access to server authentication and authorization profiles...

PT-2021-18556 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions prior to 8.8.2 Description: The issue arises when using ConfigurableInternodeAuthHadoopPlugin for authentication. In this scenario, distributed requests are forwarded or proxied using server credentials instead of the...

PT-2021-17659

Name of the Vulnerable Software and Affected Versions: Apache Solr versions prior to 8.8.2 Description: The ReplicationHandler in Apache Solr, normally registered at "/replication" under a Solr core, has a masterUrl also leaderUrl alias parameter used to designate another ReplicationHandler on...

Apache Solr Server-Side Request Forgery Vulnerability

Apache Solr is a standalone enterprise-class search application server. The Apache Solr server-side request forgery vulnerability can be exploited by an attacker to gain access to an intranet by constructing a request containing a malicious URL...

VulnCheck KEV: CVE-2019-0192

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side...

Apache Solr Arbitrary File Read Vulnerability

Apache Solr is an independent enterprise-class search application server , it provides similar to the external Web-service API interface . Users can request via http, to the search engine server to submit a certain format of the XML file , to generate the index ; can also be operated through the...

Arbitrary File Read Vulnerability in Apache Solr System

Apache Solr is an open source search service , using the Java language development , mainly based on HTTP and Apache Lucene implementation . Apache Solr system suffers from an arbitrary file read vulnerability, which can be exploited by an attacker to obtain sensitive information...

Exploit for Improper Restriction of XML External Entity Reference in Apache Solr

注意: 切勿利用本工具对未授权的网站进行非法攻击。由此产生的法律后果由使用者自行承担!!! AttackWebFrameworkTools 1.0 2021-03-06 AttackWebFrameworkTools For RedTeam 更新状态日志: 2021-03-06 新增DVR 摄像头exp 新增Nexus Repository Manager exp。修改默认线程数为20。增加超时时间。增加界面显示shell的路径。修复cookie bug 2021-03-03 修复某些类延时时间过短导致漏洞检测不准确。下一个版本将调整默认线程数字预计是20或者10 2021-02-27 ...

Security Bulletin: A vulnerability in Apache Solr (lucene) affects IBM InfoSphere Information Server

Summary A vulnerability in Apache Solr lucene was addressed by IBM InfoSphere Information Server. Vulnerability Details CVEID: CVE-2017-3164 DESCRIPTION: Apache Solr is vulnerable to server-side request forgery, caused by not having corresponding allowlist mechanism in the shards parameter. By...

Security Bulletin: Vulnerability in Apache Solr affecting Watson Knowledge Catalog for IBM Cloud Pak for Data

Summary There is a missing authorization vulnerability in the Apache Solr service that is distributed as part of Watson Knowledge Catalog for IBM Cloud Pak for Data. The issue is now addressed. Vulnerability Details CVEID: CVE-2020-13957 DESCRIPTION: Apache Solr could allow a remote attacker to...

Security Bulletin: A security bypass vulnerability in Apache Solr (lucene) affects IBM InfoSphere Information Server

Summary A security bypass vulnerability in Apache Solr lucene used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID: CVE-2020-13957 DESCRIPTION: Apache Solr could allow a remote attacker to bypass security restrictions, caused by improper access control by the...

Security Bulletin: Vulnerability related to unauthenticated uploads in Apache Solr affect IBM Operations Analytics - Log Analysis (CVE-2020-13957)

Summary Unauthenticated configset uploads vulnerability in Apache Solr affects IBM Operations Analytics - Log Analysis have been addressed. Vulnerability Details CVEID: CVE-2020-13957 DESCRIPTION: Apache Solr could allow a remote attacker to bypass security restrictions, caused by improper access...