CVE-2017-3163

CVE-2017-3163: fallo en Apache Solr

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache Solr+ Monitorear org.apache.solr:solr-core

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 6.6%
When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path traversal, leaving any file readable to the Solr server process exposed. Solr servers protected and restricted by firewall rules and/or authentication would not be at risk since only trusted clients and users would gain direct HTTP access.
Productos afectados
Apache Software Foundation · Apache Solr
CVEs relacionadas — Apache Solr

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-27905—SSRF vulnerability with the Replication handlerEPSS 93.1%CVE-2024-45216CRITICALApache Solr: Authentication bypass possible using a fake URL Path endingEPSS 92.7%CVE-2023-50386HIGHApache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSetsEPSS 83.7%CVE-2019-0192—CVE-2019-0192EPSS 78.2%CVE-2023-50290MEDIUMApache Solr: Host environment variables are published via the Metrics APIEPSS 68.4%CVE-2024-52012MEDIUMApache Solr: Configset upload on Windows allows arbitrary path write-accessEPSS 47.1%