CVE-2017-3164

Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive)

published March 8, 2019

CVSS
—
EPSS
19%
Percentile
97.3
In the wild
Unconfirmed
What it is

Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.19442 · 97.3th percentile
Published
2019-03-08T21:00Z
EPSS history
Timeline
  • 08 MAR 21:00Z
    Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive)
    cvelistv5