CVE-2021-44548

Name: CVE-2021-44548
Creator: NVD / NIST
Published: 2021-12-23T09:15:06.693+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 5.09%

Last modified Jun 17, 2026

CVE-2021-44548 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. EPSS estimates a 5.09% chance of exploitation in the next 30 days.

Description

An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

5.09%

91.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Apache	Solr	< 8.11.1

References

https://security.netapp.com/advisory/ntap-20220114-0005/Third Party Advisory
https://solr.apache.org/security.html#cve-2021-44548-apache-solr-information-disclosure-vulnerability-through-dataimporthandlerVendor Advisory
https://security.netapp.com/advisory/ntap-20220114-0005/Third Party Advisory
https://solr.apache.org/security.html#cve-2021-44548-apache-solr-information-disclosure-vulnerability-through-dataimporthandlerVendor Advisory

Timeline

Published: Dec 23, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-44548?

How severe is CVE-2021-44548?

CVE-2021-44548 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 5.09% probability of exploitation in the next 30 days.

How do I fix CVE-2021-44548?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-44548?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST