Non notée
CVE-2017-3164 Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive)
Description
Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Solr | Versions non publiées |
Autres CVE de Apache Solr
Les 24 CVE de Apache Solr →
CVE-2026-44825
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0…
8.1
Élevée
CVE-2026-22022
Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable…
Non notée
CVE-2026-22444
The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters,…
Non notée
CVE-2025-24814
Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use…
Non notée