CVE-2021-44548

An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows.

• CWE-20
• CWE-40
• CWE-22

• https://security.netapp.com/advisory/ntap-20220114-0005/Third Party Advisory
• https://solr.apache.org/security.html#cve-2021-44548-apache-solr-information-disclosure-vulnerability-through-dataimporthandlerVendor Advisory
• https://security.netapp.com/advisory/ntap-20220114-0005/Third Party Advisory
• https://solr.apache.org/security.html#cve-2021-44548-apache-solr-information-disclosure-vulnerability-through-dataimporthandlerVendor Advisory

Published

Dec 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-44541A vulnerability was found in Privoxy which was fixed in proc…7.5
• CVE-2021-44542A memory leak vulnerability was found in Privoxy when handli…7.5
• CVE-2021-44543An XSS vulnerability was found in Privoxy which was fixed in…6.1
• CVE-2021-44544DIAEnergie Version 1.7.5 and prior is vulnerable to multiple…6.1
• CVE-2021-44545Improper input validation for some Intel(R) PROSet/Wireless …6.5
• CVE-2021-44547A sandboxing issue in Odoo Community 15.0 and Odoo Enterpris…9.1
• CVE-2021-44549Apache Sling Commons Messaging Mail provides a simple layer …7.4
• CVE-2021-4455The Wordpress Plugin Smart Product Review plugin for WordPre…9.8
• CVE-2021-44550An Incorrect Access Control vulnerability exists in CoreNLP …9.8
• CVE-2021-44554Thinfinity VirtualUI before 3.0 allows a malicious actor to …5.3
• CVE-2021-44556National Library of the Netherlands digger < 6697d1269d981e3…9.1
• CVE-2021-44557National Library of the Netherlands multiNER <= c0440948057a…9.1