The TYPO3 extension "Apache Solr for TYPO3 - Enterprise Search" improperly neutralizes special elements in data query logic (CWE-943). It passes user-supplied search query parameters directly to Apache Solr without restricting advanced query syntax such as wildcards, field selectors, and range queries. This flaw allows a remote, unauthenticated attacker to enumerate indexed field names and extract stored values using boolean- and range-based blind extraction techniques, regardless of site-specific configuration. The vulnerability affects versions =13.0.0, =12.0.0, >=13.0.0 <13.1.4, >=12.0.0 <12.1.4, and <11.6.6. The CVSS 4.0 base score is 6.3, indicating medium severity. No patch or official remediation guidance is currently available.

An unauthenticated remote attacker can exploit this vulnerability to enumerate indexed field names and extract stored data values from the Apache Solr index used by the TYPO3 extension. This could lead to unauthorized disclosure of sensitive information stored in the search index. The impact is limited to information disclosure without integrity or availability effects. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the search functionality or applying custom query filtering to limit advanced Solr query syntax if possible.