Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2021-29943

Опубликовано: 12 апр. 2021
Источник: redhat
CVSS3: 9.1

Описание

When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.

A flaw was found in solr. Server credentials, instead of client credentials, are used for authenticating forward/proxy distributed requests using the ConfigurableInternodeAuthHadoopPlugin resulting in incorrect authorization resolution on the receiving hosts. The highest threat from this vulnerability is to data confidentiality and integrity.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Fuse 7solrNot affected
Red Hat Integration Camel K 1camel-solrNot affected
Red Hat JBoss Data Virtualization 6solrOut of support scope
Red Hat JBoss Enterprise Application Platform 6solrOut of support scope
Red Hat JBoss Fuse 6solrOut of support scope
Red Hat JBoss Fuse Service Works 6solrOut of support scope
Red Hat JBoss Web Server 3solrNot affected

Показывать по

Дополнительная информация

Статус:

Important
Дефект:
CWE-863
https://bugzilla.redhat.com/show_bug.cgi?id=1949521solr: unprivileged users may be able to perform unauthorized read/write to collections

9.1 Critical

CVSS3

Связанные уязвимости

CVSS3: 9.1
ubuntu
почти 5 лет назад

When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.

CVSS3: 9.1
nvd
почти 5 лет назад

When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.

CVSS3: 9.1
debian
почти 5 лет назад

When using ConfigurableInternodeAuthHadoopPlugin for authentication, A ...

CVSS3: 9.1
github
больше 4 лет назад

Incorrect Authorization in Apache Solr

9.1 Critical

CVSS3