Json response for search reveals Solr credentials

published 2023-11-03 3y ago modified 2024-12-04 last yr.

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Impact An error in Ibexa's Solr search engine results in potential exposure of Solr credentials. This is a critical vulnerability and all supported versions of the engine are affected. Those not using the Solr search engine are not affected.

### Patches The issue is fixed in all supported versions of ibexa/solr, see "Patched versions". An advisory is also published for ezsystems/ezplatform-solr-search-engine, please see that repository. Commit: https://github.com/ibexa/solr/commit/2f8b711874bee1ebe31fb8a6362e0c8e52c53012

### Workarounds None.

### References https://developers.ibexa.co/security-advisories/ibexa-sa-2023-005-vulnerabilities-in-solr-search-and-file-downloads

Patch / fix

fixed in 1 links 1

packagist ibexa/solr 4.5.4

github.com/ibexa/solr@2f8b711 commit

Is GHSA-v6xp-ccvx-w52m in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
packagist	ibexa/solr	>=4.5.0, <4.5.4	4.5.4

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

GitHub Advisory GHSA-v6xp-ccvx-w52m

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.