GitHub Advisoryadvisory · Maven

GHSA-vf7p-j8x6-xvwp Incorrect Authorization in Apache Solr

CRITICAL Published 2021-05-10 Modified 2021-04-23 Official page ↗
Aliases
CVE-2021-29943
Ecosystem
Maven
Packages
org.apache.solr:solr-parent
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-863
Reviewed
2021-04-14

Affected packages

• Maven org.apache.solr:solr-parent: < 8.8.2 → fixed in 8.8.2

Description

When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.

Related

Alias · CVE (1)

  • CVE-2021-29943 When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References