Extension Apache Solr For Typo3 Enterprise Search
Monthly
Cache-poisoning-based access control bypass in the Apache Solr for TYPO3 Enterprise Search extension allows anonymous visitors to read pages that should be protected by extendToSubpages-inherited frontend-group restrictions. The extension fails to isolate its forged access-restriction state during indexer sub-requests, writing empty frontend-group and subpage-inheritance flags into the shared TYPO3 rootline cache, where they persist and serve subsequent user requests without the original restrictions applied. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 7.6 with combined high confidentiality and integrity impact reflects meaningful severity for any TYPO3 deployment relying on page-level inherited access controls.
Frontend detail-view document lookup in the Apache Solr for TYPO3 Enterprise Search extension bypasses both the siteHash isolation filter and frontend user access controls, allowing retrieval of Solr-indexed documents outside normal authorization constraints. An unauthenticated visitor who obtains or guesses a valid Solr document ID can access content restricted to specific sites or authenticated frontend users by querying the detail-view endpoint directly, circumventing the access controls enforced on the regular search path. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 6.3 with AC:H and AT:P reflects that exploitation depends on obtaining valid document IDs.
Filter injection in the EXT:solr (Apache Solr for TYPO3 - Enterprise Search) extension enables unauthenticated visitors to bypass per-site document isolation on shared Solr cores, exposing public search-indexed content belonging to adjacent TYPO3 site installations. The flaw exists because user-supplied additionalFilters request parameters can pre-register a named siteHash filter that the query builder then refuses to overwrite, undermining the multi-tenancy boundary the extension relies upon for site separation. No public exploit code has been identified at time of analysis, and exploitation is gated on a specific shared-core deployment pattern; no active exploitation is confirmed.
PHP Object Injection in the Apache Solr for TYPO3 enterprise search extension allows authenticated low-privileged users to achieve arbitrary code execution on the server when user-generated content can reach indexed fields configured with SOLR_CLASSIFICATION, SOLR_MULTIVALUE, or SOLR_RELATION content object types. The extension's indexer passes multi-value field values rendered by the content object renderer directly to PHP's unserialize() function rather than a safe serialization format, creating a CWE-502 attack surface exploitable via PHP gadget chains. No public exploit code has been identified at time of analysis, though the vulnerability class is well-understood and commonly weaponized; the CVSS 4.0 score of 7.7 reflects the severe potential impact tempered by meaningful exploitation preconditions.
Unrestricted Solr query syntax passthrough in the TYPO3 EXT:solr enterprise search extension exposes indexed data to remote unauthenticated attackers via blind injection techniques. By crafting queries that exploit Solr's native field selectors, wildcards, and range operators, an attacker can enumerate schema field names and systematically extract stored values without triggering obvious errors. No public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.3 reflects high attack complexity (AC:H/AT:P) that limits opportunistic mass exploitation.
Cache-poisoning-based access control bypass in the Apache Solr for TYPO3 Enterprise Search extension allows anonymous visitors to read pages that should be protected by extendToSubpages-inherited frontend-group restrictions. The extension fails to isolate its forged access-restriction state during indexer sub-requests, writing empty frontend-group and subpage-inheritance flags into the shared TYPO3 rootline cache, where they persist and serve subsequent user requests without the original restrictions applied. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 7.6 with combined high confidentiality and integrity impact reflects meaningful severity for any TYPO3 deployment relying on page-level inherited access controls.
Frontend detail-view document lookup in the Apache Solr for TYPO3 Enterprise Search extension bypasses both the siteHash isolation filter and frontend user access controls, allowing retrieval of Solr-indexed documents outside normal authorization constraints. An unauthenticated visitor who obtains or guesses a valid Solr document ID can access content restricted to specific sites or authenticated frontend users by querying the detail-view endpoint directly, circumventing the access controls enforced on the regular search path. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 6.3 with AC:H and AT:P reflects that exploitation depends on obtaining valid document IDs.
Filter injection in the EXT:solr (Apache Solr for TYPO3 - Enterprise Search) extension enables unauthenticated visitors to bypass per-site document isolation on shared Solr cores, exposing public search-indexed content belonging to adjacent TYPO3 site installations. The flaw exists because user-supplied additionalFilters request parameters can pre-register a named siteHash filter that the query builder then refuses to overwrite, undermining the multi-tenancy boundary the extension relies upon for site separation. No public exploit code has been identified at time of analysis, and exploitation is gated on a specific shared-core deployment pattern; no active exploitation is confirmed.
PHP Object Injection in the Apache Solr for TYPO3 enterprise search extension allows authenticated low-privileged users to achieve arbitrary code execution on the server when user-generated content can reach indexed fields configured with SOLR_CLASSIFICATION, SOLR_MULTIVALUE, or SOLR_RELATION content object types. The extension's indexer passes multi-value field values rendered by the content object renderer directly to PHP's unserialize() function rather than a safe serialization format, creating a CWE-502 attack surface exploitable via PHP gadget chains. No public exploit code has been identified at time of analysis, though the vulnerability class is well-understood and commonly weaponized; the CVSS 4.0 score of 7.7 reflects the severe potential impact tempered by meaningful exploitation preconditions.
Unrestricted Solr query syntax passthrough in the TYPO3 EXT:solr enterprise search extension exposes indexed data to remote unauthenticated attackers via blind injection techniques. By crafting queries that exploit Solr's native field selectors, wildcards, and range operators, an attacker can enumerate schema field names and systematically extract stored values without triggering obvious errors. No public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.3 reflects high attack complexity (AC:H/AT:P) that limits opportunistic mass exploitation.