-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIOngoing coverage of React2Shell
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from inconsistent redaction logic between endpoints. The /admin/info/properties endpoint's redaction in PropertiesRequestHandler.java used a limited regex pattern, while SystemInfoHandler.java's JVM info handling had similar limitations. The commit replaced these with centralized logic in NodeConfig using '-Dsolr.hiddenSysProps', which expanded the pattern matching. The removed RedactionUtils class and changes in property handling functions indicate where the vulnerability existed.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.solr:solr-core | maven | >= 6.0.0, < 8.11.3 | 8.11.3 |
| org.apache.solr:solr-core | maven | >= 9.0.0, < 9.3.0 | 9.3.0 |