Homepage

Improper Authentication The advisory has been revoked - it doesn't affect any version of package lucene-solr  (opens in a new tab)

Threat Intelligence

EPSS
2.19% (82nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN10-LUCENESOLR-603787
  • published19 Aug 2020
  • disclosed18 Sept 2017
Report a new vulnerability Found a mistake?

Introduced: 18 Sep 2017

CVE-2017-9803  (opens in a new tab)
CWE-287  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream lucene-solr package and not the lucene-solr package as distributed by Debian.

Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application. There are two issues with this functionality (when using SecurityAwareZkACLProvider type of ACL provider e.g. SaslZkACLProvider). Firstly, access to the security configuration can be leaked to users other than the solr super user. Secondly, malicious users can exploit this leaked configuration for privilege escalation to further expose/modify private data and/or disrupt operations in the Solr cluster. The vulnerability is fixed from Apache Solr 6.6.1 onwards.