NVD

Id
88083  
Name
CVE-2017-7660  
Description
Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious node is a member of the cluster. So, if Solr users have enabled BasicAuth authentication mechanism using the BasicAuthPlugin or if the user has implemented a custom Authentication plugin, which does not implement either HttpClientInterceptorPlugin or HttpClientBuilderPlugin, his/her servers are vulnerable to this attack. Users who only use SSL without basic authentication or those who use Kerberos are not affected.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Pub Date
2017-07-18  
Published
2017-07-07  
Modified Date
2017-07-17  
Seq
2017-7660  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
423643 88083 CVE-2017-6657 http://blog.snort.org/2017/05/snort-vulnerabilities-found.html  View
423644 88083 CVE-2017-6657 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170515-snort  View
423645 88083 CVE-2017-6657 http://blog.snort.org/2017/05/snort-vulnerabilities-found.html  View
423646 88083 CVE-2017-6657 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170515-snort  View
430393 88083 CVE-2017-0668 99470  View
430394 88083 CVE-2017-0668 https://source.android.com/security/bulletin/2017-07-01  View
430395 88083 CVE-2017-0668 99470  View
430396 88083 CVE-2017-0668 https://source.android.com/security/bulletin/2017-07-01  View

Related JVN