GHSA-vf7p-j8x6-xvwp
Incorrect Authorization in Apache Solr
At a glance
- Published
- Updated
- CVE
- CVE-2021-29943
- Aliases
- BIT-solr-2021-29943
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.solr:solr-parent | introduced 0, fixed 8.8.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-29943 ADVISORY
- https://lists.apache.org/thread.html/r91dd0ff556e0c9aab4c92852e0e540c59d4633718ce12881558cf44d%40%3Cusers.solr.apache.org%3E WEB
- https://security.netapp.com/advisory/ntap-20210604-0009 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |