The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands backup, restore and deleteBackup. Each of these take a location parameter, which was not validated, i.e you could read/write to any location the solr user can access.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Solr | — | Upgrade Apache Solr to the latest version | Nov 27, 2023 | Aug 17, 2020 |
| Debian | — | Upgrade lucene-solr | Jul 30, 2024 | Aug 17, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub