title: Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings
description: When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not automatically update the ACLs.
problem types: CWE-522 Insufficiently Protected Credentials
affected:
{
product: Apache Solr
vendor: Apache Software Foundation
versions:
lessThan: 8.8.2, status: affected, version: Apache Solr, versionType: custom
}
workarounds: Manually set appropriate ACLs on /security.json znode.