Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2023-50290: Apache Solr exposes server environment variables through metrics API
CVE-2023-50290 · published 2 years ago
Summary
Apache Solr versions 9.0.0 through 9.2.x can reveal the host’s environment variables when the metrics endpoint is accessed. If a user has permission to read metrics, they could see configuration details that should remain private. Upgrade Solr to version 9.3.0 or later, or restrict the metrics‑read permission, to stop the data from being exposed.
What to do
- Update apache org.apache.solr:solr-core to version 9.3.0.
- Update apache solr to version 9.3.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | apache | org.apache.solr:solr-core |
>= 9.0.0, < 9.3.0 Fix: upgrade to 9.3.0
|
| – | apache | solr |
>= 9.0.0, < 9.3.0 cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* |
| Ubuntu:Pro:14.04:LTS | canonical | lucene-solr | All versions |
Original advisory text
Apache Solr: Host environment variables are published via the Metrics API
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.
The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess.
The Solr Metrics API is protected by the "metrics-read" permission.
Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission.
This issue affects Apache Solr: from 9.0.0 before 9.3.0.
Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.
The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess.
The Solr Metrics API is protected by the "metrics-read" permission.
Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission.
This issue affects Apache Solr: from 9.0.0 before 9.3.0.
Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.
References
- https://github.com/apache/solr/commit/35fc4bdc48171d9a64251c54a1e76deb558cf9d8
- https://issues.apache.org/jira/browse/SOLR-16808
- https://github.com/advisories/GHSA-gg7w-pw2r-x2cq
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50290... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-50290 Vendor Advisory
- https://solr.apache.org/security.html#cve-2023-50290-apache-solr-allows-read-acc... Vendor Advisory
- https://ubuntu.com/security/CVE-2023-50290 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-50290 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-200Information Exposure
Timeline
Published15 Jan 2024
Updated24 Oct 2026
First seen6 Mar 2026
Sources
GHSA-gg7w-pw2r-x2cq · GHSA
CVE-2023-50290 · NVD
CVE-2023-50290 · OSV
UBUNTU-CVE-2023-50290 · OSV
Track software like this
Free during beta