Skip to content
Fencer Intel
critical —

GHSA-7crc-r3wg-cfgf json

Json response for search reveals Solr credentials

published 3y ago modified last yr.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact An error in Ibexa's Solr search engine results in potential exposure of Solr credentials. This is a critical vulnerability and all supported versions of the engine are affected. Those not using the Solr search engine are not affected.

### Patches The issue is fixed in all supported versions of ezsystems/ezplatform-solr-search-engine, see "Patched versions". An advisory is also published for ibexa/solr, please see that repository. Commit: https://github.com/ezsystems/ezplatform-solr-search-engine/commit/1005e02cc32ff15a705857fa56171528a83b9c3e

### Workarounds None.

### References https://developers.ibexa.co/security-advisories/ibexa-sa-2023-005-vulnerabilities-in-solr-search-and-file-downloads

Patch / fix

  • packagist ezsystems/ezplatform-solr-search-engine 1.7.12, 2.0.2, 3.3.15

Is GHSA-7crc-r3wg-cfgf in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist ezsystems/ezplatform-solr-search-engine
>=3.3.0, <3.3.15
>=2.0.0, <2.0.2
>=1.7.0, <1.7.12
3.3.15
2.0.2
1.7.12

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.