Incorrect permission assignment for critical resource in Apache Solr - CVE-2023-50292

Vulnerability identifier: #VU86633

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-50292

CWE-ID: CWE-732

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect permissions assignment in Solr Schema Designer when handling new Schemas and configSets. A remote attacker can load a malicious configSets and execute arbitrary code on the target system.

Apache Solr
Log Analysis
IBM OpenPages with Watson
Operational Decision Manager

Install updates from vendor's website.

Apache Solr - addressed in versions 8.11.2, 9.3.0
Log Analysis - update to 1.3.8.2
IBM OpenPages with Watson - addressed in versions 8.3.0.3, 9.0.0.3
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 54, 8.11.0.1 Interim fix 29, 8.11.1 Interim fix 21, 8.12.0.1 Interim fix 3

• https://solr.apache.org/security.html#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions
• http://www.openwall.com/lists/oss-security/2024/02/09/3
• https://lists.apache.org/thread/jkfgxrjmpo9tqv8yqbnnbfbsorpncch4

• Multiple vulnerabilities in Apache Solr
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in IBM OpenPages with Watson
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis