CVE-2023-50290
Apache Solr: Host environment variables are published via the Metrics API
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess.
The Solr Metrics API is protected by the "metrics-read" permission. Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission. This issue affects Apache Solr: from 9.0.0 before 9.3.0.
Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess.
The Solr Metrics API is protected by the "metrics-read" permission. Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission. This issue affects Apache Solr: from 9.0.0 before 9.3.0.
Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.
- Record
CVE-2023-50290- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List
Apache Solr: Host environment variables are published via the Metrics API
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess.
The Solr Metrics API is protected by the "metrics-read" permission. Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission. This issue affects Apache Solr: from 9.0.0 before 9.3.0.
Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.
- Record
CVE-2023-50290- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2024-0354
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess.
The Solr Metrics API is protected by the "metrics-read" permission. Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission. This issue affects Apache Solr: from 9.0.0 before 9.3.0.
Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.
- Record
EUVD-2024-0354- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gg7w-pw2r-x2cq
Apache Solr allows read access to host environmet variables
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.
The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess.
The Solr Metrics API is protected by the "metrics-read" permission. Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission.
This issue affects Apache Solr: from 9.0.0 before 9.3.0.
Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.
- Record
GHSA-gg7w-pw2r-x2cq- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Apache Solr: Host environment variables are published via the Metrics API
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess.
The Solr Metrics API is protected by the "metrics-read" permission. Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission. This issue affects Apache Solr: from 9.0.0 before 9.3.0.
Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.
- Record
CVE-2023-50290- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-gg7w-pw2r-x2cq
Apache Solr allows read access to host environmet variables
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.
The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess.
The Solr Metrics API is protected by the "metrics-read" permission. Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission.
This issue affects Apache Solr: from 9.0.0 before 9.3.0.
Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.
- Record
GHSA-gg7w-pw2r-x2cq- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-50290
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess. The Solr Metrics API is protected by the "metrics-read" permission. Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission. This issue affects Apache Solr: from 9.0.0 before 9.3.0. Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.
- Record
UBUNTU-CVE-2023-50290- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVBIT-solr-2023-50290 No score
Apache Solr: Host environment variables are published via the Metrics API
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess.
The Solr Metrics API is protected by the "metrics-read" permission. Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission. This issue affects Apache Solr: from 9.0.0 before 9.3.0.
Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.
- Record
BIT-solr-2023-50290- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.solr:solr-coreMaven |
9.0.0 up to 9.3.0 | 9.3.0 |
solrBitnami |
9.0.0 up to 9.3.0 | 9.3.0 |
org.apache.solr:solr-coreMaven |
9.0.0 up to 9.3.0, plus listed versions 9.1.09.1.19.2.09.2.1 |
9.3.0 |
lucene-solrUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-13.6.2+dfsg-23.6.2+dfsg-2ubuntu0.1~esm13.6.2+dfsg-2ubuntu0.1~esm23.6.2+dfsg-2ubuntu0.1~esm4 |
None known |
lucene-solrUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-73.6.2+dfsg-83.6.2+dfsg-8ubuntu0.13.6.2+dfsg-8ubuntu0.1+esm1 |
None known |
lucene-solrUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-103.6.2+dfsg-113.6.2+dfsg-18~18.043.6.2+dfsg-18~18.04.1~esm2 |
None known |
lucene-solrUbuntu:20.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-203.6.2+dfsg-22 |
None known |
lucene-solrUbuntu:22.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-24 |
None known |
lucene-solrUbuntu:24.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-26 |
None known |
lucene-solrUbuntu:25.10 |
All versions, plus listed versions 3.6.2+dfsg-26 |
None known |
lucene-solrUbuntu:26.10 |
All versions, plus listed versions 3.6.2+dfsg-27 |
None known |
lucene-solrUbuntu:26.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-263.6.2+dfsg-27 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Apache Solr - Host Environment Variables Leak via Metrics API | |
| PoC in GitHub | desaivinayak449/bug-bounty-reports-desai-vinayak | 2025-11-06 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-50290 is a medium vulnerability (CVSS 6.5) in Apache Solr, published January 15, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 68.4%, the 99th percentile. Fixed in org.apache.solr:solr-core 9.3.0.
References
solr.apache.org/security.html
nvd.nist.gov/vuln/detail/CVE-2023-50290
github.com/apache/solr/commit/35fc4bdc48171d9a64251c54a1e76deb558cf9d8
issues.apache.org/jira/browse/SOLR-16808
ubuntu.com/security/CVE-2023-50290
cve.org/CVERecord?id=CVE-2023-50290