CVE-2017-3164

HIGH

Server-Side Request Forgery (SSRF) in org.apache.solr:solr-core

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2017-3164 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC.

Description

Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

Affected products and versions

2
ProductSourceVersion range

Apache Solr

Browse Apache Software Foundation / Apache Solr
CVE ListApache Solr 1.3.0 to 1.4.1, 3.1.0 to 3.6.2, 4.0.0 to 4.10.4, 5.0.0 to 5.5.5, 6.0.0 to 6.6.5, 7.0.0 to 7.6.0affected

org.apache.solr:solr-core

Browse Maven / org.apache.solr:solr-core
GitHub Advisory1.3.0 to < 7.7.0 · Fixed in 7.7.0affected

Proofs of concept

1

Repository PoCs

GitHubtdwyer/PoC_CVE-2017-3164_CVE-2017-1262Repository PoCby tdwyer3Not analyzed12 files

10.6 KiB · linked to 3 vulnerabilities

GitHub
PoC details

References

Showing 12 of 23