by Kastro
Paper/Archive/CVE-2021-29943

CVE-2021-29943

Apache Software Foundation Apache Solr — Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections

EPSS 5%CVSS 9.1
critical.is priorityof 100
46
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 91.8.918 × 2018.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.

Affected

ProductAffectedFixed inSource
Apache SolrApache Solr – < 8.8.28.8.2CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

reflists.apache.org/thread.html/r91dd0ff556e0c9aab4c92852e0e540c59d4633718ce12881558cf44d%40%3Cusers.solr.apache.org%3Erefsecurity.netapp.com/advisory/ntap-20210604-0009