CVE-2017-7660

Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious node is a member of the cluster. So, if Solr users have enabled BasicAuth authentication mechanism using the BasicAuthPlugin or if the user has implemented a custom Authentication plugin, which does not implement either "HttpClientInterceptorPlugin" or "HttpClientBuilderPlugin", his/her servers are vulnerable to this attack. Users who only use SSL without basic authentication or those who use Kerberos are not affected.

• CWE-287

• http://mail-archives.us.apache.org/mod_mbox/www-announce/201707.mbox/%3CCAOOKt53EgrybaD%2BiSn-nBbvFdse-szhg%3DhMoDZuvUvyMme-Z%3Dg%40mail.gmail.com%3EMailing List, Vendor Advisory
• http://www.securityfocus.com/bid/99485Third Party Advisory, VDB Entry
• https://security.netapp.com/advisory/ntap-20181127-0003/
• http://mail-archives.us.apache.org/mod_mbox/www-announce/201707.mbox/%3CCAOOKt53EgrybaD%2BiSn-nBbvFdse-szhg%3DhMoDZuvUvyMme-Z%3Dg%40mail.gmail.com%3EMailing List, Vendor Advisory
• http://www.securityfocus.com/bid/99485Third Party Advisory, VDB Entry
• https://security.netapp.com/advisory/ntap-20181127-0003/

Published

Jul 7, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-7654In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulne…
• CVE-2017-7655In Eclipse Mosquitto version from 1.0 to 1.4.15, a Null Dere…7.5
• CVE-2017-7656In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all confi…
• CVE-2017-7657In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all confi…9.8
• CVE-2017-7658In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (al…9.8
• CVE-2017-7659A maliciously constructed HTTP/2 request could cause mod_htt…
• CVE-2017-7661Apache CXF Fediz ships with a number of container-specific p…
• CVE-2017-7662Apache CXF Fediz ships with an OpenId Connect (OIDC) service…
• CVE-2017-7663Both global and Room chat are vulnerable to XSS attack in Ap…
• CVE-2017-7664Uploaded XML documents were not correctly validated in Apach…
• CVE-2017-7665In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are …
• CVE-2017-7666Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Reques…