cnvd - cnvd-2019-41284

CNVD-2019-41284

Vulnerability from cnvd - Published: 2019-11-19

Title

Apache Solr认证绕过漏洞

Description

Apache Solr是美国阿帕奇（Apache）软件基金会的一款基于Lucene（一款全文搜索引擎）的搜索服务器。该产品支持层面搜索、垂直搜索、高亮显示搜索结果等。 Apache Solr中存在认证绕过漏洞，攻击者可利用该漏洞绕过安全限制并执行未授权的操作。

Severity

高

Patch Name

Apache Solr认证绕过漏洞的补丁

Patch Description

Apache Solr是美国阿帕奇（Apache）软件基金会的一款基于Lucene（一款全文搜索引擎）的搜索服务器。该产品支持层面搜索、垂直搜索、高亮显示搜索结果等。 Apache Solr中存在认证绕过漏洞，攻击者可利用该漏洞绕过安全限制并执行未授权的操作。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://issues.apache.org/jira/browse/SOLR

Reference

https://nvd.nist.gov/vuln/detail/CVE-2018-11802 https://seclists.org/oss-sec/2019/q2/58

Impacted products

Name
['Apache Solr 6.0', 'Apache Solr 6.6', 'Apache Solr 6.5', 'Apache Solr 6.4', 'Apache Solr 6.3', 'Apache Solr 6.2', 'Apache Solr 7.6', 'Apache Solr 7.3.1', 'Apache Solr 7.0', 'Apache Solr 6.6.5', 'Apache Solr 6.6.4', 'Apache Solr 6.6.3', 'Apache Solr 6.6.2', 'Apache Solr 6.6.1', 'Apache Solr 7.3', 'Apache Solr 6.1']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "108078"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-11802",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11802"
    }
  },
  "description": "Apache Solr\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u57fa\u4e8eLucene\uff08\u4e00\u6b3e\u5168\u6587\u641c\u7d22\u5f15\u64ce\uff09\u7684\u641c\u7d22\u670d\u52a1\u5668\u3002\u8be5\u4ea7\u54c1\u652f\u6301\u5c42\u9762\u641c\u7d22\u3001\u5782\u76f4\u641c\u7d22\u3001\u9ad8\u4eae\u663e\u793a\u641c\u7d22\u7ed3\u679c\u7b49\u3002\n\nApache Solr\u4e2d\u5b58\u5728\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u5b89\u5168\u9650\u5236\u5e76\u6267\u884c\u672a\u6388\u6743\u7684\u64cd\u4f5c\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://issues.apache.org/jira/browse/SOLR",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-41284",
  "openTime": "2019-11-19",
  "patchDescription": "Apache Solr\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u57fa\u4e8eLucene\uff08\u4e00\u6b3e\u5168\u6587\u641c\u7d22\u5f15\u64ce\uff09\u7684\u641c\u7d22\u670d\u52a1\u5668\u3002\u8be5\u4ea7\u54c1\u652f\u6301\u5c42\u9762\u641c\u7d22\u3001\u5782\u76f4\u641c\u7d22\u3001\u9ad8\u4eae\u663e\u793a\u641c\u7d22\u7ed3\u679c\u7b49\u3002\r\n\r\nApache Solr\u4e2d\u5b58\u5728\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u5b89\u5168\u9650\u5236\u5e76\u6267\u884c\u672a\u6388\u6743\u7684\u64cd\u4f5c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Solr\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache Solr  6.0",
      "Apache Solr 6.6",
      "Apache Solr 6.5",
      "Apache Solr 6.4",
      "Apache Solr 6.3",
      "Apache Solr 6.2",
      "Apache Solr 7.6",
      "Apache Solr 7.3.1",
      "Apache Solr 7.0",
      "Apache Solr 6.6.5",
      "Apache Solr 6.6.4",
      "Apache Solr 6.6.3",
      "Apache Solr 6.6.2",
      "Apache Solr 6.6.1",
      "Apache Solr 7.3",
      "Apache Solr 6.1"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2018-11802\r\nhttps://seclists.org/oss-sec/2019/q2/58",
  "serverity": "\u9ad8",
  "submitTime": "2019-04-30",
  "title": "Apache Solr\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2018-11802 (GCVE-0-2018-11802)

Vulnerability from cvelistv5 – Published: 2020-04-01 21:11 – Updated: 2024-08-05 08:17

Summary

In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).

Severity ?

No CVSS data available.

CWE

Authorization bypass

Assigner

apache

References

URL

Tags

https://www.openwall.com/lists/oss-security/2019/…

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Apache	Apache Solr	Affected: before 7.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:17:09.126Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2019/04/24/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Solr",
          "vendor": "Apache",
          "versions": [
            {
              "status": "affected",
              "version": "before 7.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Authorization bypass",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-01T21:11:38",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.openwall.com/lists/oss-security/2019/04/24/1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2018-11802",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Solr",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 7.7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Authorization bypass"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.openwall.com/lists/oss-security/2019/04/24/1",
              "refsource": "MISC",
              "url": "https://www.openwall.com/lists/oss-security/2019/04/24/1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2018-11802",
    "datePublished": "2020-04-01T21:11:38",
    "dateReserved": "2018-06-05T00:00:00",
    "dateUpdated": "2024-08-05T08:17:09.126Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2019-41284

CVE-2018-11802 (GCVE-0-2018-11802)

Tags

Sightings

Nomenclature