{"id":"CVE-2021-29943","published":"2021-04-13T06:35:22Z","modified":"2024-08-03T22:18:03Z","title":"Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections","vendor":"Apache","product":"Apache Solr","tier":"tail","description":{"text":"When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04665,"percentile":0.91721,"provenance":"source"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://lists.apache.org/thread.html/r91dd0ff556e0c9aab4c92852e0e540c59d4633718ce12881558cf44d%40%3Cusers.solr.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20210604-0009/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.3,"factors":[{"name":"EPSS percentile","points":18.34}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Solr","versions":[">= Apache Solr, < 8.8.2"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.solr:solr-parent","vulnerableRanges":["<8.8.2"],"patched":["8.8.2"],"from":["GHSA-vf7p-j8x6-xvwp"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1201","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-13941","published":"2020-08-17","fixed":"8.6.0","kev":false},{"cve":"CVE-2020-13957","published":"2020-10-13","fixed":"8.6.3","kev":false,"link":{"from":"CVE-2020-13957","to":"CVE-2021-29943","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.solr:solr-parent","fromFixed":"8.6.3","toFixed":"8.8.2","daysApart":182}]}},{"cve":"CVE-2021-27905","published":"2021-04-13","fixed":"8.8.2","kev":false},{"cve":"CVE-2021-29943","published":"2021-04-13","fixed":"8.8.2","kev":false},{"cve":"CVE-2021-44548","published":"2021-12-23","fixed":"8.11.1","kev":false,"link":{"from":"CVE-2021-29943","to":"CVE-2021-44548","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.solr:solr-parent","fromFixed":"8.8.2","toFixed":"8.11.1","daysApart":254}]}}],"package":"Maven:org.apache.solr:solr-parent"}}