1. Home
  2. Security Advisories
  3. Maven
  4. MAVEN:GHSA-VRH8-27Q8-FR8F

[MAVEN:GHSA-VRH8-27Q8-FR8F] Server-Side Request Forgery (SSRF) in org.apache.solr:solr-core

Severity High
Affected Packages 1
Fixed Packages 1
CVEs 1
Info Packages References Vulnerabilities

Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL.

Package Affected Version
pkg:maven/org.apache.solr/solr-core >= 1.30, <= 7.6.0
Package Fixed Version
pkg:maven/org.apache.solr/solr-core = 7.7.0
ID
MAVEN:GHSA-VRH8-27Q8-FR8F
Severity
high
URL
https://github.com/advisories/GHSA-vrh8-27q8-fr8f
Published
2019-03-14T15:39:56
(5 years ago)
Modified
2023-01-11T05:04:10
(20 months ago)
Rights
Maven Security Team
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.apache.solr/solr-core org.apache.solr solr-core >= 1.30 <= 7.6.0
Fixed pkg:maven/org.apache.solr/solr-core org.apache.solr solr-core = 7.7.0
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date