Security Digest · Critical advisory (no CVE assigned)
GHSA-v6xp-ccvx-w52m: Json response for search reveals Solr credentials
Impact An error in Ibexa's Solr search engine results in potential exposure of Solr credentials.
GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
composer audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Composer (PHP) | ibexa/solr | >= 4.5.0, < 4.5.4 | 4.5.4 |
Details
Impact An error in Ibexa's Solr search engine results in potential exposure of Solr credentials. This is a critical vulnerability and all supported versions of the engine are affected. Those not using the Solr search engine are not affected.
Patches The issue is fixed in all supported versions of ibexa/solr, see "Patched versions". An advisory is also published for ezsystems/ezplatform-solr-search-engine, please see that repository. Commit: https://github.com/ibexa/solr/commit/2f8b711874bee1ebe31fb8a6362e0c8e52c53012
Workarounds None.
References https://developers.ibexa.co/security-advisories/ibexa-sa-2023-005-vulnerabilities-in-solr-search-and-file-downloads
Sources and references
- GitHub Advisory GHSA-v6xp-ccvx-w52m github.com
- github.com github.com
- github.com github.com
Critical Composer (PHP) advisories · Today’s Security Digest