Metacat, a data repository software, prior to version 3.4.2, improperly forwards the client-controlled 'qt' parameter through Apache SolrJ from search endpoints to its privileged Solr backend. An unauthenticated attacker can select the /admin/file handler, which SolrJ reformats into a request accepted even when handleSelect=false is configured on Solr 7.0 or later. This leads to disclosure of internal core configuration files like solrconfig.xml embedded in XML processing error responses, enabling infrastructure profiling. The issue is addressed in Metacat version 3.4.2.

An unauthenticated attacker can retrieve internal Solr core configuration files, such as solrconfig.xml, which may reveal sensitive infrastructure details. The confidentiality impact is limited to information disclosure; integrity and availability are not affected. This can aid attackers in profiling the infrastructure for further attacks.

Upgrade Metacat to version 3.4.2 or later, where this vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed fixed in 3.4.2.