漏洞标题
Apache Solr：系统属性红删除逻辑不一致可能导致密码泄露
漏洞描述信息
Apache Solr中的“不足以保护的凭据”漏洞。
此问题影响了Apache Solr：从6.0.0到8.11.2，以及9.0.0之前的版本至9.3.0之前。9.3.0和8.11.3之后修复了这个问题。
Solr Cloud中启用了授权的系统，只有登录并具有“config-read”权限的用户才会受到漏洞影响。
建议用户升级到至少9.3.0或8.11.3版本，以修复此问题。
现在只有一个选项来控制所有端点隐藏Java系统属性，“-Dsolr.hiddenSysProps”。默认情况下，所有已知敏感属性（包括“-Dbasicauth”）都被隐藏。同时也会隐藏任何名称包含“secret”或“password”的属性。无法升级的用户也可以使用以下Java系统属性来解决此问题：
```
-Dsolr.redaction.system.pattern=.*(password|secret|basicauth).*'
```
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
漏洞类别
不充分的凭证保护机制
漏洞标题
Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords
漏洞描述信息
Insufficiently Protected Credentials vulnerability in Apache Solr.
This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0.
One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties that had "password" contained in the name.
There are a number of sensitive system properties, such as "basicauth" and "aws.secretKey" do not contain "password", thus their values were published via the "/admin/info/properties" endpoint.
This endpoint populates the list of System Properties on the home screen of the Solr Admin page, making the exposed credentials visible in the UI.
This /admin/info/properties endpoint is protected under the "config-read" permission.
Therefore, Solr Clouds with Authorization enabled will only be vulnerable through logged-in users that have the "config-read" permission.
Users are recommended to upgrade to version 9.3.0 or 8.11.3, which fixes the issue.
A single option now controls hiding Java system property for all endpoints, "-Dsolr.hiddenSysProps".
By default all known sensitive properties are hidden (including "-Dbasicauth"), as well as any property with a name containing "secret" or "password".
Users who cannot upgrade can also use the following Java system property to fix the issue:
'-Dsolr.redaction.system.pattern=.*(password|secret|basicauth).*'
CVSS信息
N/A
漏洞类别
不充分的凭证保护机制
漏洞标题
Apache Solr 安全漏洞
漏洞描述信息
Apache Solr是美国阿帕奇（Apache）基金会的一款基于Lucene（一款全文搜索引擎）的搜索服务器。该产品支持层面搜索、垂直搜索、高亮显示搜索结果等。 Apache Solr 6.0.0版本至8.11.2版本、9.0.0版本至9.3.0之前版本存在安全漏洞，该漏洞源于系统属性编辑逻辑不一致，可能会泄露某些密码。
CVSS信息
N/A
漏洞类别
其他