漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
N/A
Vulnerability Description
Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application. There are two issues with this functionality (when using SecurityAwareZkACLProvider type of ACL provider e.g. SaslZkACLProvider). Firstly, access to the security configuration can be leaked to users other than the solr super user. Secondly, malicious users can exploit this leaked configuration for privilege escalation to further expose/modify private data and/or disrupt operations in the Solr cluster. The vulnerability is fixed from Apache Solr 6.6.1 onwards.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Apache Solr 授权问题漏洞
Vulnerability Description
Apache Solr是美国阿帕奇（Apache）软件基金会的一款基于Lucene（一款全文搜索引擎）的搜索服务器。该产品支持层面搜索、垂直搜索、高亮显示搜索结果等。Kerberos plugin是其中的一个网络认证协议插件。 Apache Solr 6.2.0版本至6.6.0版本中的Kerberos插件的delegation token功能存在安全漏洞。攻击者可利用该漏洞获取安全配置信息，提升权限，公开/更改个人数据或造成拒绝服务。
CVSS Information
N/A
Vulnerability Type
N/A