cvelist/2017/3xxx/CVE-2017-3164.json

{
    "CVE_data_meta":{
        "ASSIGNER":"security@apache.org",
        "DATE_PUBLIC":"2019-02-12T00:00:00",
        "ID":"CVE-2017-3164",
        "STATE":"PUBLIC"
    },
    "affects":{
        "vendor":{
            "vendor_data":[
                {
                    "product":{
                        "product_data":[
                            {
                                "product_name":"Apache Solr",
                                "version":{
                                    "version_data":[
                                        {
                                            "version_value":"Apache Solr 1.3.0 to 1.4.1, 3.1.0 to 3.6.2, 4.0.0 to 4.10.4, 5.0.0 to 5.5.5, 6.0.0 to 6.6.5, 7.0.0 to 7.6.0"
                                        }
                                    ]
                                }
                            }
                        ]
                    },
                    "vendor_name":"Apache Software Foundation"
                }
            ]
        }
    },
    "data_format":"MITRE",
    "data_type":"CVE",
    "data_version":"4.0",
    "description":{
        "description_data":[
            {
                "lang":"eng",
                "value":"Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the \"shards\" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL."
            }
        ]
    },
    "problemtype":{
        "problemtype_data":[
            {
                "description":[
                    {
                        "lang":"eng",
                        "value":"Server Side Request Forgery"
                    }
                ]
            }
        ]
    },
    "references":{
        "reference_data":[
            {
                "name":"107026",
                "refsource":"BID",
                "url":"http://www.securityfocus.com/bid/107026"
            },
            {
                "name":"[www-announce] 20190212 [SECURITY] CVE-2017-3164 SSRF issue in Apache Solr",
                "refsource":"MLIST",
                "url":"http://mail-archives.apache.org/mod_mbox/www-announce/201902.mbox/%3CCAECwjAVjBN%3DwO5rYs6ktAX-5%3D-f5JDFwbbTSM2TTjEbGO5jKKA%40mail.gmail.com%3E"
            },
            {
                "refsource":"MLIST",
                "name":"[lucene-dev] 20190325 [jira] [Commented] (SOLR-12770) [CVE-2017-3164] Make it possible to configure a shards whitelist for master/slave",
                "url":"https://lists.apache.org/thread.html/75dc651478f9d04505b46d44fe3ac739e7aaf3d7bf1257973685f8f7@%3Cdev.lucene.apache.org%3E"
            },
            {
                "refsource":"MLIST",
                "name":"[lucene-dev] 20190327 [jira] [Commented] (SOLR-12770) [CVE-2017-3164] Make it possible to configure a shards whitelist for master/slave",
                "url":"https://lists.apache.org/thread.html/ca3105b6934ccd28e843dffe39724f6963ff49825e9b709837203649@%3Cdev.lucene.apache.org%3E"
            },
            {
                "refsource":"CONFIRM",
                "name":"https://security.netapp.com/advisory/ntap-20190327-0003/",
                "url":"https://security.netapp.com/advisory/ntap-20190327-0003/"
            },
            {
                "refsource":"MLIST",
                "name":"[lucene-dev] 20190405 [jira] [Updated] (SOLR-12770) [CVE-2017-3164] Make it possible to configure a shards whitelist for master/slave",
                "url":"https://lists.apache.org/thread.html/e0f9c652b57a91fdcc287efcead620af9f4d8e46b88f0b761aa265de@%3Cdev.lucene.apache.org%3E"
            },
            {
                "refsource":"MLIST",
                "name":"[lucene-dev] 20190405 [jira] [Commented] (SOLR-12770) [CVE-2017-3164] Make it possible to configure a shards whitelist for master/slave",
                "url":"https://lists.apache.org/thread.html/43026507844ada1ac658ccf7bc939378c13e492fd6538416ce65df39@%3Cdev.lucene.apache.org%3E"
            },
            {
                "url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
            }
        ]
    }
}