Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the shards     parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server     could make Solr perform an HTTP GET request to any reachable URL. (CVE-2017-3164)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards"
    parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server
    could make Solr perform an HTTP GET request to any reachable URL. (CVE-2017-3164)

Server Side Request Forgery in Apache Solr, versions 1.3.0 until 7.6.0 (inclusive). A remote, unauthenticated attacker can use the 'shards' parameter to make a HTTP GET request to any reachable web server; as this does not use any applicable whitelist or URL validation.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera Unifier installation running on the remote web server is 15.x or 16.x prior to 16.2.15.9 or 17.7.x prior to 17.12.11 or 18.x prior to 18.8.11. It is, therefore, affected by multiple vulnerabilities:

  - A deserialization vulnerability exists in the Apache Solr     subcomponent of Primavera Unifier. An unauthenticated,     remote attacker can exploit this, via a specially crafted     request to the Solr Config API, to execute arbitrary code     on the target host. (CVE-2019-0192)

  - A denial of service (DoS) vulnerability exists in the Apache     Tika subcomponent of Primavera Unifier due to incorrect parsing     of a crafted sqlite file. An unauthenticated, remote attacker     can exploit this issue by convincing a user to open a     specially crafted file to cause the application to stop     responding. (CVE-2018-17197)

  - A server side request forgery exists in the Apache Solr     subcomponent of Primavera Unifier. An unauthenticated     remote attacker can exploit this issue to make Solr     perform an HTTP GET request to any reachable URL.
    (CVE-2017-3164)

  - A cross-site scripting (XSS) vulnerability exists due to     improper validation of user-supplied input before returning     it to users. An unauthenticated, remote attacker can exploit     this, by convincing a user to click a specially crafted URL,     to execute arbitrary script code in a user's browser session,     which could lead to unauthorized read, update, insert or     delete access to a subset of Primavera Unifier data.
    (CVE-2015-9251)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
254462	Linux Distros Unpatched Vulnerability : CVE-2017-3164	Nessus	Misc.	Local	high
422063	SCA: security update for org.apache.solr:solr-core (GHSA-vrh8-27q8-fr8f)	Tenable Cloud Security	SCA Checks	Local	high
422063	SCA: security update for org.apache.solr:solr-core (GHSA-vrh8-27q8-fr8f)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
98896	Apache Solr 1.3.0 <= 7.6.0 Server Side Request Forgery	Web App Scanning	Component Vulnerability	Version Based	high
126829	Oracle Primavera Unifier Multiple Vulnerabilities (Jul 2019 CPU)	Nessus	CGI abuses	Remote	critical

Detections

Analytics

CVE-2017-3164

high

Tenable Plugins

high

high

high

high

critical