Skip to content
CVE Tracker
Back

CVE-2017-7660

Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially…

High7.5EPSS 5.6%
Published
Updated
Reserved
Assigned by
apache

Description

Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious node is a member of the cluster. So, if Solr users have enabled BasicAuth authentication mechanism using the BasicAuthPlugin or if the user has implemented a custom Authentication plugin, which does not implement either "HttpClientInterceptorPlugin" or "HttpClientBuilderPlugin", his/her servers are vulnerable to this attack. Users who only use SSL without basic authentication or those who use Kerberos are not affected.

Scores

CVSS scores of CVE-2017-7660, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.0High7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS (exploitation in 30 days)
5.6% · top 7.1% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

Affected products

  • Apache Software Foundation · Apache Solr

    • affected 5.3 to 5.5.4
    • affected 6.0 to 6.5.1

Affected packages

From reviewed advisories of the GitHub Advisory Database.

References (3)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .