| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| org.apache.solr:solr-core | ≥ 6.0.0, < 6.4.1< 5.5.4 | 6.4.15.5.4 |
| solr | = 6.0.0= 6.0.1= 6.1.0= 6.2.0= 6.2.1= 6.3.0= 6.4.0≤ 5.5.3 |
When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path traversal, leaving any file readable to the Solr server process exposed. Solr servers protected and restricted by firewall rules and/or authentication would not be at risk since only trusted clients and users would gain direct HTTP access.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン