Sign-up

ID

VAR-202112-1645


CVE

CVE-2021-44548


TITLE

Apache Solr  Past traversal vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2021-017399

DESCRIPTION

An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows. Apache Solr Exists in a past traversal vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Apache Solr is a search server based on Lucene (a full-text search engine) of the Apache Foundation in the United States. The product supports level search, vertical search, highlight search results, etc. Apache Solr has security flaws that could allow attackers to gain wider access to the network, potentially leading to SMB attacks

Trust: 2.25

sources: NVD: CVE-2021-44548 // JVNDB: JVNDB-2021-017399 // CNVD: CNVD-2022-08349 // VULMON: CVE-2021-44548

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-08349

AFFECTED PRODUCTS

vendor:apachemodel:solrscope:ltversion:8.11.1

Trust: 1.6

vendor:apachemodel:solrscope:eqversion:8.11.1

Trust: 0.8

vendor:apachemodel:solrscope:eqversion: -

Trust: 0.8

sources: CNVD: CNVD-2022-08349 // JVNDB: JVNDB-2021-017399 // NVD: CVE-2021-44548

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-44548
value: CRITICAL

Trust: 1.0

NVD: CVE-2021-44548
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2022-08349
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202112-1742
value: CRITICAL

Trust: 0.6

VULMON: CVE-2021-44548
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-44548
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2022-08349
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-44548
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2021-44548
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-08349 // VULMON: CVE-2021-44548 // JVNDB: JVNDB-2021-017399 // CNNVD: CNNVD-202112-1742 // NVD: CVE-2021-44548

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.0

problemtype:CWE-40

Trust: 1.0

problemtype:CWE-20

Trust: 1.0

problemtype:Path traversal (CWE-22) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-017399 // NVD: CVE-2021-44548

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202112-1742

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-202112-1742

PATCH

title:2021-12-18, CVE-2021-44548url:https://solr.apache.org/security.html#cve-2021-44548-apache-solr-information-disclosure-vulnerability-through-dataimporthandler

Trust: 0.8

title:Patch for Apache Solr Input Validation Error Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/317631

Trust: 0.6

title:Apache Solr Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=176615

Trust: 0.6

sources: CNVD: CNVD-2022-08349 // JVNDB: JVNDB-2021-017399 // CNNVD: CNNVD-202112-1742

EXTERNAL IDS

db:NVDid:CVE-2021-44548

Trust: 3.9

db:JVNDBid:JVNDB-2021-017399

Trust: 0.8

db:CNVDid:CNVD-2022-08349

Trust: 0.6

db:AUSCERTid:ESB-2021.4319

Trust: 0.6

db:CNNVDid:CNNVD-202112-1742

Trust: 0.6

db:VULMONid:CVE-2021-44548

Trust: 0.1

sources: CNVD: CNVD-2022-08349 // VULMON: CVE-2021-44548 // JVNDB: JVNDB-2021-017399 // CNNVD: CNNVD-202112-1742 // NVD: CVE-2021-44548

REFERENCES

url:https://security.netapp.com/advisory/ntap-20220114-0005/

Trust: 2.4

url:https://solr.apache.org/security.html#cve-2021-44548-apache-solr-information-disclosure-vulnerability-through-dataimporthandler

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-44548

Trust: 1.4

url:https://mail-archives.apache.org/mod_mbox/www-announce/202112.mbox/%3ccecd82e9-6dfc-6603-10b6-be71055d004f@apache.org%3e

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.4319

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/22.html

Trust: 0.1

url:https://cwe.mitre.org/data/definitions/20.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:http://seclists.org/oss-sec/2021/q4/167

Trust: 0.1

sources: CNVD: CNVD-2022-08349 // VULMON: CVE-2021-44548 // JVNDB: JVNDB-2021-017399 // CNNVD: CNNVD-202112-1742 // NVD: CVE-2021-44548

SOURCES

db:CNVDid:CNVD-2022-08349
db:VULMONid:CVE-2021-44548
db:JVNDBid:JVNDB-2021-017399
db:CNNVDid:CNNVD-202112-1742
db:NVDid:CVE-2021-44548

LAST UPDATE DATE

2024-11-23T22:20:42.272000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-08349date:2022-02-05T00:00:00
db:VULMONid:CVE-2021-44548date:2022-01-07T00:00:00
db:JVNDBid:JVNDB-2021-017399date:2023-01-17T08:19:00
db:CNNVDid:CNNVD-202112-1742date:2022-08-10T00:00:00
db:NVDid:CVE-2021-44548date:2024-11-21T06:31:12.457

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-08349date:2022-02-04T00:00:00
db:VULMONid:CVE-2021-44548date:2021-12-23T00:00:00
db:JVNDBid:JVNDB-2021-017399date:2023-01-17T00:00:00
db:CNNVDid:CNNVD-202112-1742date:2021-12-20T00:00:00
db:NVDid:CVE-2021-44548date:2021-12-23T09:15:06.693