VDB

CVE-2017-3164

CVE-2017-3164 PUBLISHED

Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL.

EPSS 59.54% · 98.3th percentile

Risk Scores

EPSS Score
59.54%
98.3th percentile

Affected Products

VendorProductVersions
Ubuntu:25.10lucene-solr0, 3.6.2+dfsg-26
Ubuntu:Pro:14.04:LTSlucene-solr*, 0, 3.6.2+dfsg-2ubuntu0.1~esm1
Ubuntu:Pro:16.04:LTSlucene-solr3.6.2+dfsg-8, *, 0
Ubuntu:20.04:LTSlucene-solr*, 0, 3.6.2+dfsg-20
Ubuntu:Pro:18.04:LTSlucene-solr*, 0, 3.6.2+dfsg-10
Ubuntu:24.04:LTSlucene-solr0, 3.6.2+dfsg-26
Ubuntu:22.04:LTSlucene-solr3.6.2+dfsg-24, 0

Exploit Intelligence

…and 15 more exploits

Timeline

  • Mar 8, 2019 CVE Published
  • Apr 14, 2021 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Aug 12, 2023 EPSS Score
  • Nov 8, 2023 EPSS Score
  • May 23, 2024 EPSS Score
  • Aug 11, 2024 EPSS Score
  • Dec 17, 2024 EPSS Score
  • Mar 17, 2025 EPSS Score
  • Mar 20, 2025 EPSS Score
  • Mar 27, 2025 EPSS Score
  • Mar 28, 2025 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›