CVE-2017-3164

Published: 08/03/2019 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache solr

Debian Bug report logs - #922242 lucene-solr: CVE-2017-3164 Package: src:lucene-solr; Maintainer for src:lucene-solr is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 13 Feb 2019 16:45:06 UTC Severity: important Tags: fixed-upst ...

CVE-2017-3164 SSRF issue in Apache Solr Severity: High Vendor: The Apache Software Foundation Versions Affected: Apache Solr versions from 13 to 760 Description: The "shards" parameter does not have a corresponding whitelist mechanism, so it can request any URL Mitigation: Upgrade to Apache Solr 770 or later Ensure your network settings ...

Apache Solr Poc CVE-2017-3164 CVE-2017-12629

Apache Solr Poc CVE-2017-3164 CVE-2017-12629 This folder contains example exploits for Apache Solr CVE-2017-3164 CVE-2017-12629 To be use ONLY for education purposes and with full permission of the Apache Solr Server owner You will need to know the IP or DNS name of the Apache Solr server and the name of a Collection CVE-2017-3164 Server Side Request Forgery in Apache Solr, v

CWE-918 http://mail-archives.apache.org/mod_mbox/www-announce/201902.mbox/%3CCAECwjAVjBN%3DwO5rYs6ktAX-5%3D-f5JDFwbbTSM2TTjEbGO5jKKA%40mail.gmail.com%3E http://www.securityfocus.com/bid/107026 https://security.netapp.com/advisory/ntap-20190327-0003/https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html https://www.oracle.com/security-alerts/cpuoct2020.html https://lists.apache.org/thread.html/75dc651478f9d04505b46d44fe3ac739e7aaf3d7bf1257973685f8f7%40%3Cdev.lucene.apache.org%3E https://lists.apache.org/thread.html/ca3105b6934ccd28e843dffe39724f6963ff49825e9b709837203649%40%3Cdev.lucene.apache.org%3E https://lists.apache.org/thread.html/e0f9c652b57a91fdcc287efcead620af9f4d8e46b88f0b761aa265de%40%3Cdev.lucene.apache.org%3E https://lists.apache.org/thread.html/43026507844ada1ac658ccf7bc939378c13e492fd6538416ce65df39%40%3Cdev.lucene.apache.org%3E https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E https://lists.apache.org/thread.html/rc400db37710ee79378b6c52de3640493ff538c2beb41cefdbbdf2ab8%40%3Ccommits.submarine.apache.org%3E https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=922242 https://github.com/tdwyer/PoC_CVE-2017-3164_CVE-2017-1262

CVE-2017-3164

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

Github Repositories

References

Vulmon Search

About

Products

Connect