Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous…
Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 contain a flaw in the protection that blocks dangerous features from being configured in a ConfigSet uploaded through the API. An attacker who can reach the Solr API without authentication or authorization can use a combination of UPLOAD and CREATE actions to circumvent those checks and enable such features.
Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) appeared 7 months after disclosure. No confirmed exploitation is recorded.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+7 mo
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
6 fixes in solr-parent over 21 months. The latest fix listed for solr-parent is 8.11.1.
Fixes in solr-parentMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
- 7.7.0CVE-2018-118021 Apr 2020
- 8.6.0CVE-2020-1394117 Aug 2020
- 8.6.3CVE-2020-1395713 Oct 2020
- 8.8.2CVE-2021-2790513 Apr 2021
- 8.8.2CVE-2021-2994313 Apr 2021
- 8.11.1CVE-2021-4454823 Dec 2021Latest listed
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV3 packages in 1 ecosystem. No single main package: each of these ships the affected code.
- Mavenorg.apache.solr:solr-parentAffected: 6.6.0 up to 8.6.3Upgrade to 8.8.2 or later
- Mavenorg.apache.solr:solr-solrjAffected: 6.6.0 up to 8.6.3Upgrade to 8.6.3 or later
- Mavenorg.apache.solr:solr-coreAffected: 6.6.0 up to 8.6.3Upgrade to 8.11.3 or later