CVE-2021-44548: Apache Solr information disclosure vulnerability through DataImportHandler
First published: Thu Dec 23 2021(Updated: )
An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Solr | <8.11.1 | |
| Microsoft Windows | ||
| All of | ||
| Apache Solr | <8.11.1 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-44548?
CVE-2021-44548 is an Improper Input Validation vulnerability in the DataImportHandler of Apache Solr.
What is the severity of CVE-2021-44548?
CVE-2021-44548 has a severity rating of 9.8, which is classified as critical.
How does CVE-2021-44548 work?
CVE-2021-44548 allows an attacker to provide a Windows UNC path, triggering an SMB network call from the Solr host to another host on the network.
What is the affected software for CVE-2021-44548?
CVE-2021-44548 affects Apache Solr version up to 8.11.1.
How can I fix CVE-2021-44548?
To fix CVE-2021-44548, it is recommended to update Apache Solr to a version that addresses the vulnerability.
- collector/nvd-index
- agent/type
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/tags
- agent/softwarecombine
- agent/event
- vendor/apache
- canonical/apache solr
- vendor/microsoft
- canonical/microsoft windows