Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. Solr Streaming Expressions allows users to extract data from other Solr Clouds, using a "zkHost" parameter. When original SolrCloud is setup to use ZooKeeper credentials and ACLs, they will be sent to whatever "zkHost" the user provides. An attacker could setup a server to mock ZooKeeper, that accepts ZooKeeper requests with credentials and ACLs and extracts the sensitive information, then send a streaming expression using the mock server's address in "zkHost". Streaming Expressions are exposed via the "/streaming" handler, with "read" permissions. Users are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the issue. From these versions on, only zkHost values that have the same server address (regardless of chroot), will use the given ZooKeeper credentials and ACLs when connecting.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects
    Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. Solr Streaming Expressions allows users
    to extract data from other Solr Clouds, using a "zkHost" parameter. When original SolrCloud is setup to
    use ZooKeeper credentials and ACLs, they will be sent to whatever "zkHost" the user provides. An attacker
    could setup a server to mock ZooKeeper, that accepts ZooKeeper requests with credentials and ACLs and
    extracts the sensitive information, then send a streaming expression using the mock server's address in
    "zkHost". Streaming Expressions are exposed via the "/streaming" handler, with "read" permissions. Users
    are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the issue. From these versions on, only
    zkHost values that have the same server address (regardless of chroot), will use the given ZooKeeper
    credentials and ACLs when connecting. (CVE-2023-50298)

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory.

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (Apache Solr)). Supported versions that are affected are 19.12.0-19.12.16, 20.12.0-20.12.16,     21.12.0-21.12.17, 22.12.0-22.12.12 and 23.12.0-23.12.3. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Primavera     Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible     data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.
    (CVE-2023-50298)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (Apache Solr)). Supported versions that are affected are 19.12.0-19.12.16, 20.12.0-20.12.16,     21.12.0-21.12.17, 22.12.0-22.12.12 and  23.12.0-23.12.3. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Primavera     Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible     data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.
    (CVE-2023-50386)

  - Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress. This     issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to     version 1.26.0 which fixes the issue. (CVE-2024-25710)

  - Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress. This issue     affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26,     which fixes the issue. (CVE-2024-26308)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
420651	SCA: security update for org.apache.solr:solr-solrj, org.apache.solr:solr-solrj-streaming (GHSA-xrj7-x7gp-wwqr)	Tenable Cloud Security	SCA Checks	high
420651	SCA: security update for org.apache.solr:solr-solrj, org.apache.solr:solr-solrj-streaming (GHSA-xrj7-x7gp-wwqr)	Tenable Self-Hosted Container Security	SCA Checks	high
193436	Oracle Primavera Unifier (April 2024 CPU)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2023-50298

high

Tenable Plugins

high

high

high