7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
6.3 Medium
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
19.4%
A flaw was found in Apache Solr. Streaming Expressions allow users to extract data from other Solr Clouds using a “zkHost” parameter. When the original SolrCloud is set up to use ZooKeeper credentials and ACLs, they will be sent to whichever “zkHost” the user provides. An attacker could set up a server to impersonate ZooKeeper that accepts ZooKeeper requests with credentials and ACLs and extract sensitive information, then send a streaming expression using the malicious server’s address in “zkHost”. Streaming Expressions are exposed via the “/streaming” handler with “read” permissions.
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
6.3 Medium
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
19.4%