Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. In the affected versions, Solr ConfigSets accepted Java jar and class files to be uploaded through the ConfigSets API. When backing up Solr Collections, these configSet files would be saved to disk when using the LocalFileSystemRepository (the default for backups). If the backup was saved to a directory that Solr uses in its ClassPath/ClassLoaders, then the jar and class files would be available to use with any ConfigSet, trusted or untrusted. When Solr is run in a secure way (Authorization enabled), as is strongly suggested, this vulnerability is limited to extending the Backup permissions with the ability to add libraries. Users are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the issue. In these versions, the following protections have been added: * Users are no longer able to upload files to a configSet that could be executed via a Java ClassLoader. * The Backup API restricts saving backups to directories that are used in the ClassLoader.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type,
    Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects
    Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. In the affected versions, Solr ConfigSets
    accepted Java jar and class files to be uploaded through the ConfigSets API. When backing up Solr
    Collections, these configSet files would be saved to disk when using the LocalFileSystemRepository (the
    default for backups). If the backup was saved to a directory that Solr uses in its ClassPath/ClassLoaders,
    then the jar and class files would be available to use with any ConfigSet, trusted or untrusted. When Solr
    is run in a secure way (Authorization enabled), as is strongly suggested, this vulnerability is limited to
    extending the Backup permissions with the ability to add libraries. Users are recommended to upgrade to
    version 8.11.3 or 9.4.1, which fix the issue. In these versions, the following protections have been
    added: * Users are no longer able to upload files to a configSet that could be executed via a Java
    ClassLoader. * The Backup API restricts saving backups to directories that are used in the ClassLoader.
    (CVE-2023-50386)

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory.

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (Apache Solr)). Supported versions that are affected are 19.12.0-19.12.16, 20.12.0-20.12.16,     21.12.0-21.12.17, 22.12.0-22.12.12 and 23.12.0-23.12.3. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Primavera     Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible     data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.
    (CVE-2023-50298)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (Apache Solr)). Supported versions that are affected are 19.12.0-19.12.16, 20.12.0-20.12.16,     21.12.0-21.12.17, 22.12.0-22.12.12 and  23.12.0-23.12.3. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Primavera     Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible     data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.
    (CVE-2023-50386)

  - Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress. This     issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to     version 1.26.0 which fixes the issue. (CVE-2024-25710)

  - Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress. This issue     affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26,     which fixes the issue. (CVE-2024-26308)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
409381	SCA: security update for org.apache.solr:solr-core (GHSA-37vr-vmg4-jwpw)	Tenable Cloud Security	SCA Checks	high
409381	SCA: security update for org.apache.solr:solr-core (GHSA-37vr-vmg4-jwpw)	Tenable Self-Hosted Container Security	SCA Checks	high
193436	Oracle Primavera Unifier (April 2024 CPU)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2023-50386

high

Tenable Plugins

high

high

high