Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-r413-tvjg-mfh3
Vulnerability ID VCID-r413-tvjg-mfh3
Aliases CVE-2017-7660
GHSA-c82r-qg3w-q5mv
Summary Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious node is a member of the cluster. So, if Solr users have enabled BasicAuth authentication mechanism using the BasicAuthPlugin or if the user has implemented a custom Authentication plugin, which does not implement either "HttpClientInterceptorPlugin" or "HttpClientBuilderPlugin", his/her servers are vulnerable to this attack. Users who only use SSL without basic authentication or those who use Kerberos are not affected.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-287 Improper Authentication
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-7660.json
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2017-7660
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2017-7660
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2017-7660
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2017-7660
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2017-7660
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2017-7660
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2017-7660
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2017-7660
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2017-7660
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-c82r-qg3w-q5mv
cvssv3.1 7.5 https://issues.apache.org/jira/browse/SOLR-10624
generic_textual HIGH https://issues.apache.org/jira/browse/SOLR-10624
cvssv3.1 7.5 https://lists.apache.org/thread/o0g7vpz5sz4yy0pyf1z94vkpv40x6h44
generic_textual HIGH https://lists.apache.org/thread/o0g7vpz5sz4yy0pyf1z94vkpv40x6h44
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2017-7660
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2017-7660
cvssv3.1 7.5 https://security.netapp.com/advisory/ntap-20181127-0003
generic_textual HIGH https://security.netapp.com/advisory/ntap-20181127-0003
Reference id Reference type URL
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7660
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-7660.json
https://api.first.org/data/v1/epss?cve=CVE-2017-7660
https://github.com/apache/lucene-solr/commit/2f5ecbcf9ed7a3a4fd37b5c55860ad8eace1bea
https://github.com/apache/lucene-solr/commit/9f91c619a35db89544f5c85795df4128c9f0d96
https://github.com/apache/lucene-solr/commit/e3b0cfff396a7f92a4f621d598780116da916f3
https://github.com/apache/lucene-solr/commit/e912b7cb5c68fbb87b874d41068cf5a3aea17da0
https://issues.apache.org/jira/browse/SOLR-10624
https://lists.apache.org/thread/o0g7vpz5sz4yy0pyf1z94vkpv40x6h44
https://nvd.nist.gov/vuln/detail/CVE-2017-7660
https://security.netapp.com/advisory/ntap-20181127-0003
https://security.netapp.com/advisory/ntap-20181127-0003/
1473273 https://bugzilla.redhat.com/show_bug.cgi?id=1473273
GHSA-c82r-qg3w-q5mv https://github.com/advisories/GHSA-c82r-qg3w-q5mv
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-7660.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://issues.apache.org/jira/browse/SOLR-10624
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://lists.apache.org/thread/o0g7vpz5sz4yy0pyf1z94vkpv40x6h44
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2017-7660
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://security.netapp.com/advisory/ntap-20181127-0003
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.63773
EPSS Score 0.00455
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:38:21.738157+00:00 ProjectKB MSRImporter Import https://raw.githubusercontent.com/SAP/project-kb/master/MSR2019/dataset/vulas_db_msr2019_release.csv 38.0.0