Описание
When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not automatically update the ACLs.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Fuse 7 | solr | Not affected | ||
| Red Hat Integration Camel K 1 | camel-solr | Not affected | ||
| Red Hat JBoss Data Virtualization 6 | solr | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform 6 | solr | Out of support scope | ||
| Red Hat JBoss Fuse 6 | solr | Out of support scope | ||
| Red Hat JBoss Fuse Service Works 6 | solr | Out of support scope | ||
| Red Hat JBoss Web Server 3 | solr | Not affected |
Показывать по
Дополнительная информация
Статус:
5.9 Medium
CVSS3
Связанные уязвимости
When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not automatically update the ACLs.
When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not automatically update the ACLs.
When starting Apache Solr versions prior to 8.8.2, configured with the ...
5.9 Medium
CVSS3