CVE catalog

CVE-2023-50298

lucene-solr affected and fixed versions

[CVE catalog]

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. Solr Streaming Expressions allows users to extract data from other Solr Clouds, using a "zkHost" parameter. When original SolrCloud is setup to use ZooKeeper credentials and ACLs, they will be sent to whatever "zkHost" the user provides. An attacker could setup a server to mock ZooKeeper, that accepts ZooKeeper requests with credentials and ACLs and extracts the sensitive information, then send a streaming expression using the mock server's address in "zkHost". Streaming Expressions are exposed via the "/streaming" handler, with "read" permissions. Users are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the issue. From these versions on, only zkHost values that have the same server address (regardless of chroot), will use the given ZooKeeper credentials and ACLs when connecting.

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.56% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence
Original provider fields
{
  "package_releases": [
    {
      "name": "lucene-solr",
      "status": "fixed",
      "release": "sid",
      "version": "3.6.2+dfsg-28"
    },
    {
      "name": "lucene-solr",
      "status": "fixed",
      "release": "forky",
      "version": "3.6.2+dfsg-28"
    },
    {
      "name": "lucene-solr",
      "status": "fixed",
      "release": "trixie",
      "version": "3.6.2+dfsg-26"
    },
    {
      "name": "lucene-solr",
      "status": "fixed",
      "release": "bookworm",
      "version": "3.6.2+dfsg-26"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "lucene-solr",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "3.6.2+dfsg-23"
    },
    {
      "bug": null,
      "name": "lucene-solr",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "3.6.2+dfsg-23"
    },
    {
      "bug": null,
      "name": "lucene-solr",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "3.6.2+dfsg-23"
    },
    {
      "bug": null,
      "name": "lucene-solr",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "3.6.2+dfsg-23"
    }
  ],
  "distribution_packages": []
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [liblucene3-contrib-java]Unknown

    Source package: [lucene-solr]

    Details (2)

    • 3.6.2+dfsg-26 · all · bookworm

      Fixed · Fixed: 3.6.2+dfsg-23

      dsa · lucene-solr · debian · bookworm; dsa · lucene-solr · debian · 12

    • 3.6.2+dfsg-26 · all · bookworm

      Fixed · Fixed: 3.6.2+dfsg-23

      dsa · lucene-solr · debian · bookworm; dsa · lucene-solr · debian · 12

  • [liblucene3-java]Unknown

    Source package: [lucene-solr]

    Details (2)

    • 3.6.2+dfsg-26 · all · bookworm

      Fixed · Fixed: 3.6.2+dfsg-23

      dsa · lucene-solr · debian · bookworm; dsa · lucene-solr · debian · 12

    • 3.6.2+dfsg-26 · all · bookworm

      Fixed · Fixed: 3.6.2+dfsg-23

      dsa · lucene-solr · debian · bookworm; dsa · lucene-solr · debian · 12

[Debian 13 (Trixie)]

  • [liblucene3-contrib-java]Unknown

    Source package: [lucene-solr]

    Details (2)

    • 3.6.2+dfsg-26 · all · trixie

      Fixed · Fixed: 3.6.2+dfsg-23

      dsa · lucene-solr · debian · 13

    • 3.6.2+dfsg-26 · all · trixie

      Fixed · Fixed: 3.6.2+dfsg-23

      dsa · lucene-solr · debian · 13

  • [liblucene3-java]Unknown

    Source package: [lucene-solr]

    Details (2)

    • 3.6.2+dfsg-26 · all · trixie

      Fixed · Fixed: 3.6.2+dfsg-23

      dsa · lucene-solr · debian · 13

    • 3.6.2+dfsg-26 · all · trixie

      Fixed · Fixed: 3.6.2+dfsg-23

      dsa · lucene-solr · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]