6.5

CVE-2023-50290: apache software foundation apache solr

CVSS: 6.5v3.1MediumModified
AliasesUBUNTU-CVE-2023-50290GHSA-gg7w-pw2r-x2cqBIT-solr-2023-50290
Published 15-01-2024Last modified 09-05-2025
Open JSON

Vulnerability summary

CVE-2023-50290 is a medium (CVSS 6.5) vulnerability in apache software foundation apache solr. EPSS estimates a 68.45% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities.

Overall risk
40/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
68.45%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 15-01-2024
    PublishedVulnerability first disclosed.
  2. 09-05-2025
    Last modifiedVulnerability information updated.

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess. The Solr Metrics API is protected by the "metrics-read" permission. Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission. This issue affects Apache Solr: from 9.0.0 before 9.3.0. Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

68.45%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 68.45% on 19-09-2026

19-09-202619-10-2026
EPSS score
68.45%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Apache1 product
  • solr≥ 9.0.0, < 9.3.0
Apache software foundation1 product
Org.apache.solr1 product
  • solr-core≥ 9.0.0, < 9.3.0
Ubuntu1 product
  • lucene-solrAll versions (No fix recorded)

4 vendors · 4 products

References

7 links