Non notée
CVE-2017-3164 Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive)
Description
Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Solr | Versions non publiées |
Références
- 107026 www.securityfocus.com
- [www-announce] 20190212 [SECURITY] CVE-2017-3164 SSRF issue in Apache Solr mail-archives.apache.org
- [lucene-dev] 20190325 [jira] [Commented] (SOLR-12770) [CVE-2017-3164] Make it possible to configure a shards whitelist for master/slave lists.apache.org
- [lucene-dev] 20190327 [jira] [Commented] (SOLR-12770) [CVE-2017-3164] Make it possible to configure a shards whitelist for master/slave lists.apache.org
- [lucene-dev] 20190405 [jira] [Updated] (SOLR-12770) [CVE-2017-3164] Make it possible to configure a shards whitelist for master/slave lists.apache.org
- [lucene-dev] 20190405 [jira] [Commented] (SOLR-12770) [CVE-2017-3164] Make it possible to configure a shards whitelist for master/slave lists.apache.org
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html lists.apache.org
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html lists.apache.org
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
- [submarine-commits] 20201209 [GitHub] [submarine] QiAnXinCodeSafe opened a new issue #474: There is a vulnerability in Apache Solr 5.5.4,upgrade recommended lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Solr
Les 24 CVE de Apache Solr →
CVE-2026-44825
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0…
8.1
Élevée
CVE-2026-22022
Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable…
Non notée
CVE-2026-22444
The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters,…
Non notée
CVE-2025-24814
Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use…
Non notée