CVE-2017-7660: High severity Apache SOLR vulnerability
Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious node is a member of the cluster. So, if Solr users have enabled BasicAuth authentication mechanism using the BasicAuthPlugin or if the user has implemented a custom Authentication plugin, which does not implement either "HttpClientInterceptorPlugin" or "HttpClientBuilderPlugin", his/her servers are vulnerable to this attack. Users who only use SSL without basic authentication or those who use Kerberos are not affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7660?
The severity of CVE-2017-7660 is classified as high due to potential unauthorized access and manipulation of inter-node communications.
How do I fix CVE-2017-7660?
To fix CVE-2017-7660, upgrade Apache Solr to a version that has addressed this vulnerability, specifically versions 6.5.1 or later.
What software versions are affected by CVE-2017-7660?
CVE-2017-7660 affects Apache Solr versions 5.3.0 through 6.4.2.
What is the impact of CVE-2017-7660?
The impact of CVE-2017-7660 includes the risk of an attacker intercepting and modifying communications between Solr nodes, potentially leading to data breaches.
Is CVE-2017-7660 still a threat if I update my software?
No, if you update to a patched version of Apache Solr released after the identification of CVE-2017-7660, the threat is mitigated.