{
  "cveId": "CVE-2023-50291",
  "url": "https://patchblox.com/security/cve/CVE-2023-50291",
  "summary": "CVE-2023-50291 is fixed in lucene-solr on 1 platform, first by DEBIAN-CVE-2023-50291, released February 9, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "lucene-solr: Insufficiently Protected Credentials vulnerability in Apache Solr",
  "description": "Insufficiently Protected Credentials vulnerability in Apache Solr.  This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process\u0027 Java system properties, /admin/info/properties, was only setup to hide system properties that had \u0022password\u0022 contained in the name. There are a number of sensitive system properties, such as \u0022basicauth\u0022 and \u0022aws.secretKey\u0022 do not contain \u0022password\u0022, thus their values were published via the \u0022/admin/info/properties\u0022 endpoint. This endpoint populates the list of System Properties on the home screen of the Solr Admin page, making the exposed credentials visible in the UI.  This /admin/info/properties endpoint is protected under the \u0022config-read\u0022 permission. Therefore, Solr Clouds with Authorization enabled will only be vulnerable through logged-in users that have the \u0022config-read\u0022 permission. Users are recommended to upgrade to version 9.3.0 or 8.11.3, which fixes the issue. A single option now controls hiding Java system property for all endpoints, \u0022-Dsolr.hiddenSysProps\u0022. By default all known sensitive properties are hidden (including \u0022-Dbasicauth\u0022), as well as any property with a name containing \u0022secret\u0022 or \u0022password\u0022.  Users who cannot upgrade can also use the following Java system property to fix the issue: \u00A0 \u0027-Dsolr.redaction.system.pattern=.*(password|secret|basicauth).*\u0027",
  "published": "2024-02-09T18:15:08Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss": 0.03278,
  "epssPercentile": 0.88503,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "lucene-solr",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3.6.2\u002Bdfsg-23",
      "fix": "DEBIAN-CVE-2023-50291",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-50291",
      "released": "2024-02-09T18:15:08Z"
    },
    {
      "platform": "linux",
      "product": "lucene-solr",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.6.2\u002Bdfsg-23",
      "fix": "DEBIAN-CVE-2023-50291",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-50291",
      "released": "2024-02-09T18:15:08Z"
    },
    {
      "platform": "linux",
      "product": "lucene-solr",
      "release": "Debian 14",
      "fixedVersion": "3.6.2\u002Bdfsg-23",
      "fix": "DEBIAN-CVE-2023-50291",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-50291",
      "released": "2024-02-09T18:15:08Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}