Security advisory

{
  "id": "7f9cb24bdab2dc5c00597a51fe3b8adec153a4404653695a17e5fafab3f7c756",
  "url": "https://osv.dev/vulnerability/CVE-2021-29262",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-29262",
    "summary": "When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not automatically update the ACLs.",
    "evidence": "osv:CVE-2021-29262",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2021-29262",
      "aliases": [
        "BIT-solr-2021-29262",
        "CVE-2021-29262",
        "GHSA-jgcr-fg3g-qvw8"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/apache/lucene-solr",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "a92a05e195b775b30ca410bc0a26e8e79e7b3bfb"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "8.8.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "releases/lucene-solr/8.8.1",
            "releases/lucene-solr/8.8.0",
            "history/branches/lucene-solr/lucene-6997",
            "grafts/lucene-solr-copy",
            "grafts/lucene-solr-oldest-merged",
            "grafts/lucene-oldest"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-29262.json"
          }
        }
      ],
      "modified": "2026-10-24T10:30:43.684395635Z",
      "provider": "osv",
      "references": [
        "https://lists.apache.org/thread.html/r1171f6417eeb6d5e1206d53e2b2ff2d6ee14026f8b595ef7d8a33b79%40%3Coak-issues.jackrabbit.apache.org%3E",
        "https://lists.apache.org/thread.html/r1e92a2eff6c47a65c4a6e95e809a9707181de76f8062403a0bea1012%40%3Coak-issues.jackrabbit.apache.org%3E",
        "https://lists.apache.org/thread.html/r51b29ff62060b67bc9999ded5e252b36b09311fe5a02d27f6de3e4d3%40%3Coak-issues.jackrabbit.apache.org%3E",
        "https://lists.apache.org/thread.html/r7151081abab92a827a607205c4260b0a3d22280b52d15bc909177608%40%3Coak-issues.jackrabbit.apache.org%3E",
        "https://lists.apache.org/thread.html/r8d35eeb9a470d2682b5bcf3be0b8942faa7e28f9ca5861c058d17fff%40%3Coak-issues.jackrabbit.apache.org%3E",
        "https://lists.apache.org/thread.html/r9c4ce6903218c92ef2583070e64af5a69e483821c4b3016dc41e3c6f%40%3Coak-issues.jackrabbit.apache.org%3E",
        "https://lists.apache.org/thread.html/rb6db683903174eaa44ec80cc118a38574319b0d4181f36b61ee6278f%40%3Cdev.jackrabbit.apache.org%3E",
        "https://lists.apache.org/thread.html/rbc680cbfd745f22d182158217428a296e8e398cde16f3f428fe4bddc%40%3Coak-issues.jackrabbit.apache.org%3E",
        "https://lists.apache.org/thread.html/rd85f87e559ee27e9c69795e3ad93a77621895e0328ea3df41d711d72%40%3Coak-commits.jackrabbit.apache.org%3E",
        "https://lists.apache.org/thread.html/ref84e60192f4bdc3206b247f260513e8d4e71f3e200792f75386d07a%40%3Cdev.jackrabbit.apache.org%3E",
        "https://lists.apache.org/thread.html/r536da4c4e4e406f7843461cc754a3d0a3fe575aa576e2b71a9cd57d0%40%3Cannounce.apache.org%3E",
        "https://security.netapp.com/advisory/ntap-20210604-0009/"
      ],
      "provider_metadata": {
        "unresolved_ranges": [
          {
            "cpes": [
              "cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*"
            ],
            "vendor_product": "apache:solr",
            "extracted_events": [
              {
                "range": [
                  {
                    "fixed": "8.8.2"
                  }
                ],
                "source": "CPE_RANGE"
              }
            ]
          }
        ]
      }
    },
    "related_cves": [
      {
        "value": "CVE-2021-29262",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 435680,
  "published_at": "2021-04-13T07:15:12.247+00:00"
}