{"id":"CVE-2021-29943","aliases":["BIT-solr-2021-29943","EUVD-2021-1201","GHSA-vf7p-j8x6-xvwp","UBUNTU-CVE-2021-29943"],"status":"published","title":"Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections","description":"When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.04665,"percentile":0.9187,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2021-04-13T06:35:22Z","modified":"2026-10-24T10:30:58Z","fixes":[{"ecosystem":"Maven","package":"org.apache.solr:solr-parent","fixed_in":["8.8.2"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"solr","fixed_in":["8.8.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.solr:solr-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"solr","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.8.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.solr:solr-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.2"}]}],"versions":["1.3.0","1.4.0","1.4.1","3.1.0","3.2.0","3.3.0","3.4.0","3.5.0","3.6.0","3.6.1","3.6.2","4.0.0","4.0.0-ALPHA","4.0.0-BETA","4.1.0","4.10.0","4.10.1","4.10.2","4.10.3","4.10.4","4.2.0","4.2.1","4.3.0","4.3.1","4.4.0","4.5.0","4.5.1","4.6.0","4.6.1","4.7.0","4.7.1","4.7.2","4.8.0","4.8.1","4.9.0","4.9.1","5.0.0","5.1.0","5.2.0","5.2.1","5.3.0","5.3.1","5.3.2","5.4.0","5.4.1","5.5.0","5.5.1","5.5.2","5.5.3","5.5.4","5.5.5","6.0.0","6.0.1","6.1.0","6.2.0","6.2.1","6.3.0","6.4.0","6.4.1","6.4.2","6.5.0","6.5.1","6.6.0","6.6.1","6.6.2","6.6.3","6.6.4","6.6.5","6.6.6","7.0.0","7.0.1","7.1.0","7.2.0","7.2.1","7.3.0","7.3.1","7.4.0","7.5.0","7.6.0","7.7.0","7.7.1","7.7.2","7.7.3","8.0.0","8.1.0","8.1.1","8.2.0","8.3.0","8.3.1","8.4.0","8.4.1","8.5.0","8.5.1","8.5.2","8.6.0","8.6.1","8.6.2","8.6.3","8.7.0","8.8.0","8.8.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"lucene-solr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2+dfsg-1","3.6.2+dfsg-2","3.6.2+dfsg-2ubuntu0.1~esm1","3.6.2+dfsg-2ubuntu0.1~esm2","3.6.2+dfsg-2ubuntu0.1~esm4"]}],"products":[{"vendor":"apache","product":"solr"},{"vendor":"apache software foundation","product":"apache solr"}],"references":[{"url":"https://lists.apache.org/thread.html/r91dd0ff556e0c9aab4c92852e0e540c59d4633718ce12881558cf44d%40%3Cusers.solr.apache.org%3E","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20210604-0009/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29943","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-vf7p-j8x6-xvwp"},{"url":"https://security.netapp.com/advisory/ntap-20210604-0009","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-29943","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-29943","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-29943","title":"Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections","description":"When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.","status":"published","published":"2021-04-13T06:35:22Z","modified":"2024-08-03T22:18:03.277Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:33:06.658806Z"}],"euvd":[{"id":"EUVD-2021-1201","description":"When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.","status":"published","published":"2021-04-13T06:35:22Z","modified":"2024-08-03T22:18:03Z","updated_at":"2026-11-03T03:24:43.965438Z"}],"ghsa":[{"id":"GHSA-vf7p-j8x6-xvwp","title":"Incorrect Authorization in Apache Solr","description":"When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.","status":"published","published":"2021-05-10T15:17:58Z","modified":"2023-02-01T05:05:30Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:36:34.260786Z"}],"nvd":[{"id":"CVE-2021-29943","description":"When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.","status":"published","published":"2021-04-13T07:15:12.403Z","modified":"2026-06-17T03:48:29.11Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:06:51.610648Z"}],"osv":[{"id":"CVE-2021-29943","description":"When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.","status":"published","published":"2021-04-13T07:15:12.403Z","modified":"2026-10-24T10:30:58.285916628Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"GHSA-vf7p-j8x6-xvwp","title":"Incorrect Authorization in Apache Solr","description":"When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.","status":"published","published":"2021-05-10T15:17:58Z","modified":"2024-02-17T05:32:14.45001Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:57.348035Z"},{"id":"UBUNTU-CVE-2021-29943","description":"When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.","status":"published","published":"2021-04-13T07:15:00Z","modified":"2025-09-08T16:47:06Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"BIT-solr-2021-29943","title":"Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections","description":"When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.","status":"published","published":"2024-03-06T11:06:21.01Z","modified":"2026-09-08T08:48:19.418009146Z","updated_at":"2026-11-02T15:28:35.111822Z"}]}}