Information Exposure Affecting org.apache.solr:solr-core package, versions [9.0.0,9.3.0)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
17.99% (97th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHESOLR-6156656
- published 14 Jan 2024
- disclosed 12 Jan 2024
- credit Houston Putman
Introduced: 12 Jan 2024
CVE-2023-50290 Open this link in a new tabHow to fix?
Upgrade org.apache.solr:solr-core to version 9.3.0 or higher.
Overview
org.apache.solr:solr-core is an open source enterprise search platform built on Apache Lucene
Affected versions of this package are vulnerable to Information Exposure due to the publication of host environment variables via the Metrics API. An attacker can gain access to sensitive information by exploiting the lack of protection for environment variables, which are published by default and can be set for the entire host.
CVSS Scores
version 3.1