Log in Start free

Vulnerability · Published Apr 13, 2021 · Assigned by apache

CVE-2021-29262Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings

High 7.5

In plain English

A high-severity security flaw in Apache Solr from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.7% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)6.7%top 6.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not automatically update the ACLs.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.solr:solr-core8.8.2GHSA-jgcr-fg3g-qvw8

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Solr Apache Solr – before 8.8.2

Weakness: CWE-522

References