Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/12651?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/12651?format=api", "vulnerability_id": "VCID-vsgv-kss4-nqcb", "summary": "Incorrect Authorization in Apache Solr\nIn Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 6.6.6 and 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).", "aliases": [ { "alias": "CVE-2018-11802" }, { "alias": "GHSA-j346-h5wc-rw2m" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/930192?format=api", "purl": "pkg:deb/debian/lucene-solr@0?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/lucene-solr@0%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/930190?format=api", "purl": "pkg:deb/debian/lucene-solr@3.6.2%2Bdfsg-24?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/lucene-solr@3.6.2%252Bdfsg-24%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/930188?format=api", "purl": "pkg:deb/debian/lucene-solr@3.6.2%2Bdfsg-26?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/lucene-solr@3.6.2%252Bdfsg-26%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/930191?format=api", "purl": "pkg:deb/debian/lucene-solr@3.6.2%2Bdfsg-27?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/lucene-solr@3.6.2%252Bdfsg-27%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/35315?format=api", "purl": "pkg:maven/org.apache.solr/solr-core@6.6.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3gq7-8e2z-yqcv" }, { "vulnerability": "VCID-3vmh-e7x6-3kf6" }, { "vulnerability": "VCID-4dgs-1mk2-5ubr" }, { "vulnerability": "VCID-5781-s1ny-q7ey" }, { "vulnerability": "VCID-835p-mav1-1qem" }, { "vulnerability": "VCID-a4yf-9j54-e3cp" }, { "vulnerability": "VCID-f12j-fvhp-quec" }, { "vulnerability": "VCID-ftx3-494m-hbee" }, { "vulnerability": "VCID-hpys-9ncu-3bgv" }, { "vulnerability": "VCID-jc41-ky5q-tkhv" }, { "vulnerability": "VCID-jugm-3s3r-8kf8" }, { "vulnerability": "VCID-t4p6-84y8-kbbu" }, { "vulnerability": "VCID-tt7h-4geu-5bc9" }, { "vulnerability": "VCID-uaxq-nmwp-5uct" }, { "vulnerability": "VCID-v5ka-6bd4-33ft" }, { "vulnerability": "VCID-zrn1-s7ht-pbdt" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.solr/solr-core@6.6.6" }, { "url": "http://public2.vulnerablecode.io/api/packages/35327?format=api", "purl": "pkg:maven/org.apache.solr/solr-core@7.7.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3gq7-8e2z-yqcv" }, { "vulnerability": "VCID-3vmh-e7x6-3kf6" }, { "vulnerability": "VCID-4dgs-1mk2-5ubr" }, { "vulnerability": "VCID-5781-s1ny-q7ey" }, { "vulnerability": "VCID-835p-mav1-1qem" }, { "vulnerability": "VCID-a4yf-9j54-e3cp" }, { "vulnerability": "VCID-ftx3-494m-hbee" }, { "vulnerability": "VCID-hpys-9ncu-3bgv" }, { "vulnerability": "VCID-jc41-ky5q-tkhv" }, { "vulnerability": "VCID-t4p6-84y8-kbbu" }, { "vulnerability": "VCID-tt7h-4geu-5bc9" }, { "vulnerability": "VCID-uaxq-nmwp-5uct" }, { "vulnerability": "VCID-v5ka-6bd4-33ft" }, { "vulnerability": "VCID-zrn1-s7ht-pbdt" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.solr/solr-core@7.7.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/45423?format=api", "purl": "pkg:maven/org.apache.solr/solr-parent@6.6.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3vmh-e7x6-3kf6" }, { "vulnerability": "VCID-4dgs-1mk2-5ubr" }, { "vulnerability": "VCID-835p-mav1-1qem" }, { "vulnerability": "VCID-a4yf-9j54-e3cp" }, { "vulnerability": "VCID-ftx3-494m-hbee" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.solr/solr-parent@6.6.6" }, { "url": "http://public2.vulnerablecode.io/api/packages/45421?format=api", "purl": "pkg:maven/org.apache.solr/solr-parent@7.7.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3vmh-e7x6-3kf6" }, { "vulnerability": "VCID-4dgs-1mk2-5ubr" }, { "vulnerability": "VCID-835p-mav1-1qem" }, { "vulnerability": "VCID-a4yf-9j54-e3cp" }, { "vulnerability": "VCID-ftx3-494m-hbee" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.solr/solr-parent@7.7.0" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/25050?format=api", "purl": "pkg:maven/org.apache.solr/solr-core@7.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3gq7-8e2z-yqcv" }, { "vulnerability": "VCID-3vmh-e7x6-3kf6" }, { "vulnerability": "VCID-4dgs-1mk2-5ubr" }, { "vulnerability": "VCID-5781-s1ny-q7ey" }, { "vulnerability": "VCID-835p-mav1-1qem" }, { "vulnerability": "VCID-a4yf-9j54-e3cp" }, { "vulnerability": "VCID-f12j-fvhp-quec" }, { "vulnerability": "VCID-ftx3-494m-hbee" }, { "vulnerability": "VCID-gfmc-r1h7-dfhs" }, { "vulnerability": "VCID-h9gm-dpgv-2yeh" }, { "vulnerability": "VCID-hpys-9ncu-3bgv" }, { "vulnerability": "VCID-jc41-ky5q-tkhv" }, { "vulnerability": "VCID-jugm-3s3r-8kf8" }, { "vulnerability": "VCID-rys3-pnnk-a7e4" }, { "vulnerability": "VCID-t4p6-84y8-kbbu" }, { "vulnerability": "VCID-tt7h-4geu-5bc9" }, { "vulnerability": "VCID-uaxq-nmwp-5uct" }, { "vulnerability": "VCID-v5ka-6bd4-33ft" }, { "vulnerability": "VCID-vkyg-mj2g-bqgp" }, { "vulnerability": "VCID-vsgv-kss4-nqcb" }, { "vulnerability": "VCID-zrn1-s7ht-pbdt" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.solr/solr-core@7.0.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/143260?format=api", "purl": "pkg:maven/org.apache.solr/solr-parent@7.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3vmh-e7x6-3kf6" }, { "vulnerability": "VCID-4dgs-1mk2-5ubr" }, { "vulnerability": "VCID-835p-mav1-1qem" }, { "vulnerability": "VCID-a4yf-9j54-e3cp" }, { "vulnerability": "VCID-ftx3-494m-hbee" }, { "vulnerability": "VCID-vsgv-kss4-nqcb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.solr/solr-parent@7.0.0" } ], "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-11802.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-11802.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2018-11802", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00151", "scoring_system": "epss", "scoring_elements": "0.35661", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00151", "scoring_system": "epss", "scoring_elements": "0.35512", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00151", "scoring_system": "epss", "scoring_elements": "0.35714", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00151", "scoring_system": "epss", "scoring_elements": "0.35739", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00151", "scoring_system": "epss", "scoring_elements": "0.3562", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00151", "scoring_system": "epss", "scoring_elements": "0.35666", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00151", "scoring_system": "epss", "scoring_elements": "0.35689", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00151", "scoring_system": "epss", "scoring_elements": "0.35699", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00151", "scoring_system": "epss", "scoring_elements": "0.35654", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00151", "scoring_system": "epss", "scoring_elements": "0.35632", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00151", "scoring_system": "epss", "scoring_elements": "0.35671", "published_at": "2026-04-16T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-11802" }, { "reference_url": "https://github.com/apache/lucene-solr", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/lucene-solr" }, { "reference_url": "https://github.com/apache/lucene-solr/commit/add003f217806afb4e1604f697cdb0a5a7115895", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/lucene-solr/commit/add003f217806afb4e1604f697cdb0a5a7115895" }, { "reference_url": "https://issues.apache.org/jira/browse/SOLR-12514", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.apache.org/jira/browse/SOLR-12514" }, { "reference_url": "https://www.openwall.com/lists/oss-security/2019/04/24/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.openwall.com/lists/oss-security/2019/04/24/1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1707547", "reference_id": "1707547", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1707547" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11802", "reference_id": "CVE-2018-11802", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:L/Au:S/C:P/I:N/A:N" }, { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11802" }, { "reference_url": "https://github.com/advisories/GHSA-j346-h5wc-rw2m", "reference_id": "GHSA-j346-h5wc-rw2m", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-j346-h5wc-rw2m" } ], "weaknesses": [ { "cwe_id": 863, "name": "Incorrect Authorization", "description": "The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 200, "name": "Exposure of Sensitive Information to an Unauthorized Actor", "description": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information." } ], "exploits": [], "severity_range_score": "4.0 - 6.9", "exploitability": "0.5", "weighted_severity": "6.2", "risk_score": 3.1, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vsgv-kss4-nqcb" }