| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.solr:solr-core | ≥ 1.3.0, < 7.7.0 | 7.7.0 |
| solr | ≥ 1.3.0, ≤ 7.6.0 |
Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free