CVE-2021-29262: Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings
When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not automatically update the ACLs.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this Apache Solr vulnerability?
The vulnerability ID is CVE-2021-29262.
What is the severity rating for CVE-2021-29262?
The severity rating for CVE-2021-29262 is high with a score of 7.5.
Which versions of Apache Solr are affected by CVE-2021-29262?
Apache Solr versions prior to 8.8.2 are affected by CVE-2021-29262.
What is the impact of CVE-2021-29262?
The impact of CVE-2021-29262 is that the read-only user configuration in Solr can be read by unauthorized users.
Where can I find more information about CVE-2021-29262?
You can find more information about CVE-2021-29262 at the following references: - [Reference 1](https://lists.apache.org/thread.html/r1171f6417eeb6d5e1206d53e2b2ff2d6ee14026f8b595ef7d8a33b79@%3Coak-issues.jackrabbit.apache.org%3E) - [Reference 2](https://lists.apache.org/thread.html/r1e92a2eff6c47a65c4a6e95e809a9707181de76f8062403a0bea1012@%3Coak-issues.jackrabbit.apache.org%3E) - [Reference 3](https://lists.apache.org/thread.html/r51b29ff62060b67bc9999ded5e252b36b09311fe5a02d27f6de3e4d3@%3Coak-issues.jackrabbit.apache.org%3E)