CVE-2021-29943: Incorrect Authorization

April 13, 2021 (updated June 8, 2021)

When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.

References

lists.apache.org/thread.html/r91dd0ff556e0c9aab4c92852e0e540c59d4633718ce12881558cf44d%40%3Cusers.solr.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2021-29943

Code Behaviors & Features

Detect and mitigate CVE-2021-29943 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →