GitHub Advisoryadvisory · Maven

GHSA-vrh8-27q8-fr8f Server-Side Request Forgery (SSRF) in org.apache.solr:solr-core

HIGH Published 2019-03-14 Modified 2026-04-16 Official page ↗
Aliases
CVE-2017-3164
Ecosystem
Maven
Packages
org.apache.solr:solr-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-918
Reviewed
2020-06-16

Affected packages

• Maven org.apache.solr:solr-core: >= 1.3.0, < 7.7.0 → fixed in 7.7.0

Description

Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL.

Related

Alias · CVE (1)

  • CVE-2017-3164 Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References