Advisoriesby IbisApache SolrGHSA-j346-h5wc-rw2m
Incorrect Authorization in Apache Solr
Fix: upgrade to 6.6.6 or later (2 fixed versions below)
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 6.6.6 and 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.solr:solr-core Maven | >= 7.0.0, < 7.7.0 | 7.7.0 |
| < 6.6.6 | 6.6.6 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-863
- Also known as
- CVE-2018-11802
More Apache Solr advisories
All Apache Solr
Improper Limitation of a Pathname to a Restricted Directory in Apache SolrCVE-2013-6397fixed in 4.6.0Improper Neutralization of Input During Web Page Generation in Apache SolrCVE-2015-8795fixed in 5.1.0Improper Neutralization of Input During Web Page Generation in Apache SolrCVE-2015-8797fixed in 5.3.1Apache Solr insecure inter-node communicationCVE-2017-7660fixed in 5.5.5 +1Apache Solr Kerberos delegation token functionality flawsCVE-2017-9803fixed in 6.6.1Incorrect Authorization in Apache SolrCVE-2020-13957fixed in 8.6.3