CVE-2023-50290
CVSS 3.1 Score 6.5 of 10 (medium)
Details
Summary
CVE-2023-50290 is a vulnerability affecting Apache Solr versions 9.0.0 through 9.2.9. It allows unauthorized actors to access sensitive information through the exposure of environment variables. The Solr Metrics API, protected by the "metrics-read" permission, publishes all unprotected environment variables. While users can hide some variables, the default list is limited, and environment variables cannot be strictly defined like Java system properties. This issue poses a risk to Solr Clouds with Authorization setups, as it may expose sensitive data to users with "metrics-read" permissions. To mitigate this risk, users are advised to upgrade to Apache Solr version 9.3.0 or later, which does not publish environment variables via the Metrics API.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Apache Solr
Affected Vendors
- Apache Software Foundation
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions