SB2024022039 - Multiple vulnerabilities in Apache Solr

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024022039

SB2024022039 - Multiple vulnerabilities in Apache Solr

Published: February 20, 2024

Security Bulletin ID SB2024022039
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Incorrect permission assignment for critical resource (CVE-ID: CVE-2023-50292)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect permissions assignment in Solr Schema Designer when handling new Schemas and configSets. A remote attacker can load a malicious configSets and execute arbitrary code on the target system.


2) Insufficiently protected credentials (CVE-ID: CVE-2023-50291)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to an insecure redaction logic in the "/admin/info/properties" endpoint that hid only system properties with the "password" string inside their names. A remote user with "config-read" permission can obtain credentials stored in other properties, such as "basicauth" or "aws.secretKey".


Remediation

Install update from vendor's website.

References