Improper permission handling in Apache Solr
High severity
GitHub Reviewed
Published
May 10, 2021
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Description
Published by the National Vulnerability Database
Apr 13, 2021
Reviewed
May 7, 2021
Published to the GitHub Advisory Database
May 10, 2021
Last updated
Feb 1, 2023
When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not automatically update the ACLs.
References