GitHub Advisoryadvisory · Maven

GHSA-jgcr-fg3g-qvw8 Improper permission handling in Apache Solr

HIGH Published 2021-05-10 Modified 2021-05-07 Official page ↗
Aliases
CVE-2021-29262
Ecosystem
Maven
Packages
org.apache.solr:solr-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-279, CWE-522
Reviewed
2021-05-07

Affected packages

• Maven org.apache.solr:solr-core: < 8.8.2 → fixed in 8.8.2

Description

When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not automatically update the ACLs.

Related

Alias · CVE (1)

  • CVE-2021-29262 When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and… vulnerability

Weakness · CWE (2)

  • CWE-279 Incorrect Execution-Assigned Permissions weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References