CVSS 3.0
7.5 highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2017-3163
High (7.5) in apache solr. EPSS 6.6% chance of exploitation in the next 30 days. Fixed in org.apache.solr:solr-core 5.5.4, 6.4.1.
When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path traversal, leaving any file readable to the Solr server process exposed. Solr servers protected and restricted by firewall rules and/or authentication would not be at risk since only trusted clients and users would gain direct HTTP access.
Severity
- EPSS
- 6.6% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:solr
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-387v-84cv-9qmc | Maven | org.apache.solr:solr-core | <5.5.4 | 5.5.4 |
| GHSA-387v-84cv-9qmc | Maven | org.apache.solr:solr-core | >=6.0.0 <6.4.1 | 6.4.1 |