{"id":"CVE-2017-3164","published":"2019-03-08T21:00:00Z","modified":"2024-09-16T19:52:10Z","title":"Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive)","vendor":"Apache","product":"Apache Solr","tier":"tail","description":{"text":"Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the \"shards\" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.19442,"percentile":0.97358,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/107026","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://mail-archives.apache.org/mod_mbox/www-announce/201902.mbox/%3CCAECwjAVjBN%3DwO5rYs6ktAX-5%3D-f5JDFwbbTSM2TTjEbGO5jKKA%40mail.gmail.com%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/75dc651478f9d04505b46d44fe3ac739e7aaf3d7bf1257973685f8f7%40%3Cdev.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/ca3105b6934ccd28e843dffe39724f6963ff49825e9b709837203649%40%3Cdev.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/e0f9c652b57a91fdcc287efcead620af9f4d8e46b88f0b761aa265de%40%3Cdev.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/43026507844ada1ac658ccf7bc939378c13e492fd6538416ce65df39%40%3Cdev.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20190327-0003/","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/rc400db37710ee79378b6c52de3640493ff538c2beb41cefdbbdf2ab8%40%3Ccommits.submarine.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":24.5,"factors":[{"name":"EPSS percentile","points":19.47},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2023-08-11","earliestUrl":"https://github.com/tdwyer/PoC_CVE-2017-3164_CVE-2017-1262","repos":[{"name":"tdwyer/PoC_CVE-2017-3164_CVE-2017-1262","url":"https://github.com/tdwyer/PoC_CVE-2017-3164_CVE-2017-1262","stars":3,"created":"2023-08-11"}]},"first":{"date":"2023-08-11","source":"PoC-in-GitHub","url":"https://github.com/tdwyer/PoC_CVE-2017-3164_CVE-2017-1262"},"provenance":"source"},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Solr","versions":["Apache Solr 1.3.0 to 1.4.1, 3.1.0 to 3.6.2, 4.0.0 to 4.10.4, 5.0.0 to 5.5.5, 6.0.0 to 6.6.5, 7.0.0 to 7.6.0"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.solr:solr-core","vulnerableRanges":[">=1.3.0, <7.7.0"],"patched":["7.7.0"],"from":["GHSA-vrh8-27q8-fr8f"],"provenance":"source"}],"euvd":{"id":"EUVD-2019-0392","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2018-1308","published":"2018-04-09","fixed":"7.3.0","kev":false},{"cve":"CVE-2018-8010","published":"2018-05-21","fixed":"7.3.1","kev":false},{"cve":"CVE-2018-8026","published":"2018-07-05","fixed":"7.4.0","kev":false,"link":{"from":"CVE-2018-8026","to":"CVE-2017-3164","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.solr:solr-core","fromFixed":"7.4.0","toFixed":"7.7.0","daysApart":246}]}},{"cve":"CVE-2017-3164","published":"2019-03-08","fixed":"7.7.0","kev":false},{"cve":"CVE-2018-11802","published":"2020-04-01","fixed":"7.7.0","kev":false},{"cve":"CVE-2019-0193","published":"2019-08-01","fixed":"8.2.0","kev":true},{"cve":"CVE-2019-12409","published":"2019-11-18","fixed":"8.3.0","kev":false}],"package":"Maven:org.apache.solr:solr-core"}}