Non notée
CVE-2021-27905 The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl"…
Description
The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Solr 8.8 | premières → < 8.8.2 | 8.8.2 |
Références
- lists.apache.org lists.apache.org
- security.netapp.com security.netapp.com
- [solr-users] 20210618 CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability lists.apache.org
- [solr-users] 20210618 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability lists.apache.org
- [solr-users] 20210728 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability lists.apache.org
- [ofbiz-notifications] 20210914 [jira] [Updated] (OFBIZ-12316) The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) lists.apache.org
- [ofbiz-commits] 20210915 [ofbiz-plugins] branch release18.12 updated: Fixed: The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) (OFBIZ-12316) lists.apache.org
- [ofbiz-notifications] 20210915 [jira] [Commented] (OFBIZ-12316) The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) lists.apache.org
- [ofbiz-notifications] 20210915 [jira] [Closed] (OFBIZ-12316) The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) lists.apache.org
- [ofbiz-commits] 20210915 [ofbiz-plugins] branch trunk updated: Fixed: The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) (OFBIZ-12316) lists.apache.org
- [ofbiz-commits] 20210915 [ofbiz-plugins] branch release17.12 updated: Fixed: The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) (OFBIZ-12316) lists.apache.org
- [ofbiz-notifications] 20210915 [jira] [Updated] (OFBIZ-12316) The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Solr
Les 24 CVE de Apache Solr →
CVE-2026-44825
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0…
8.1
Élevée
CVE-2026-22022
Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable…
Non notée
CVE-2026-22444
The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters,…
Non notée
CVE-2025-24814
Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use…
Non notée