CVE-2023-50290

Summary

CVE-2023-50290 is a vulnerability affecting Apache Solr versions 9.0.0 through 9.2.9. It allows unauthorized actors to access sensitive information through the exposure of environment variables. The Solr Metrics API, protected by the "metrics-read" permission, publishes all unprotected environment variables. While users can hide some variables, the default list is limited, and environment variables cannot be strictly defined like Java system properties. This issue poses a risk to Solr Clouds with Authorization setups, as it may expose sensitive data to users with "metrics-read" permissions. To mitigate this risk, users are advised to upgrade to Apache Solr version 9.3.0 or later, which does not publish environment variables via the Metrics API.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.