When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not automatically update the ACLs.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or     VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only     user is configured then Solr would not treat that node as a sensitive path and would allow it to be     readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not     automatically update the ACLs. (CVE-2021-29262)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or
    VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only
    user is configured then Solr would not treat that node as a sensitive path and would allow it to be
    readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not
    automatically update the ACLs. (CVE-2021-29262)

The version of Apache Solr running on the remote host is 7.x prior to 7.7.4, or 8.x prior to 8.8.2. It is, therefore, affected by multiple vulnerabilities, including the following: 

  - The ReplicationHandler (normally registered at '/replication' under a Solr core) has a 'masterUrl' (also     'leaderUrl' alias) parameter that is used to designate another ReplicationHandler on another Solr core to     replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these     parameters against a similar configuration it uses for the 'shards' parameter. Prior to this bug getting     fixed, it did not. (CVE-2021-27905)

  - When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or     VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only     user is configured then Solr would not treat that node as a sensitive path and would allow it to be     readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not     automatically update the ACLs. (CVE-2021-29262)     
  - When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2     would forward/proxy distributed requests using server credentials instead of original client credentials.
    This would result in incorrect authorization resolution on the receiving hosts. (CVE-2021-29943)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
255670	Linux Distros Unpatched Vulnerability : CVE-2021-29262	Nessus	Misc.	high
416351	SCA: security update for org.apache.solr:solr-core (GHSA-jgcr-fg3g-qvw8)	Tenable Cloud Security	SCA Checks	high
416351	SCA: security update for org.apache.solr:solr-core (GHSA-jgcr-fg3g-qvw8)	Tenable Self-Hosted Container Security	SCA Checks	high
181481	Apache Solr 7.x < 7.7.4 / 8.x < 8.8.2 Multiple Vulnerabilities	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2021-29262

high

Tenable Plugins

high

high

high

critical