CVE-2017-3163 — Vulnetix

Try Vulnetix Request Demo

CVE-2017-3163 PUBLISHED

When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path traversal, leaving any file readable to the Solr server process exposed. Solr servers protected and restricted by firewall rules and/or authentication would not be at risk since only trusted clients and users would gain direct HTTP access.

EPSS 16.45% · 94.8th percentile

Risk Scores

EPSS Score

16.45%

94.8th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:Pro:16.04:LTS	lucene-solr	*, 0, 3.6.2+dfsg-8
Ubuntu:Pro:14.04:LTS	lucene-solr	3.6.2+dfsg-1, 3.6.2+dfsg-2, 3.6.2+dfsg-2ubuntu0.1~esm1

Timeline

Aug 30, 2017 CVE Published
May 17, 2018 CVE Updated
Apr 14, 2021 EPSS Score
Feb 4, 2022 EPSS Score
Mar 7, 2023 EPSS Score
Mar 17, 2025 EPSS Score
Mar 22, 2025 EPSS Score
Mar 29, 2025 EPSS Score
Mar 30, 2025 EPSS Score
May 1, 2025 EPSS Score
May 4, 2025 EPSS Score
Jun 1, 2025 EPSS Score

References

https://ubuntu.com/security/CVE-2017-3163 third-party-advisory
https://issues.apache.org/jira/browse/SOLR-10031 third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2017-3163 third-party-advisory

Open in Interactive Console →