Lack of data validation In org.apache.solr:solr-core
Description
Improper Input Validation in Apache Solr Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands backup, restore and deleteBackup. Each of these take a location parameter, which was not validated, i.e you could read/write to any location the solr user can access.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 8.6.0 | ||
 debian 14 | 3.6.2+dfsg-23 | ||
debian 13 | 3.6.2+dfsg-23 | ||
debian 11 | 3.6.2+dfsg-23 | ||
debian 12 | 3.6.2+dfsg-23 | ||
maven | 8.6.0 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4. 5.