In our environment, we are using Sitecore 8.2 Update-2, and our SOLR version is 6.6.2 in cloud mode (distributed mode). During one of our security vulnerability scans our security team has pointed out few critical security issues on SOLR 6.6.2 and we also discovered that this version is at EOL (end of life). We know that the only thing left is to upgrade to the latest version of Sitecore and SOLR, but that will take a significant amount of time, so our management suggests disabling the SOLR and run Sitecore without it. As far I know Sitecore requires the SOLR to work properly. Is there any case study or link that suggest how to do it without breaking your website
1 - Solr versions 5.0–5.5.5, 6.0–6.6.5 are affected by security vulnerability CVE-2019-0192 (SOLR-13301).
As Sitecore Solr compatibility matrix KB article says you have couple of options how to solve this issue:
- Upgrade to Sitecore XP 9.1 and use Apache Solr 7.2.1.
- Disable the Config API by running Solr with the system property disable.configEdit=true.
- Upgrade to Solr 6.6.6
- If upgrading or disabling the Config API are not viable options, apply SOLR-13301.patch and re-compile Solr.
- Ensure your network settings are configured so that only trusted traffic is allowed to ingress/egress your hosts running Solr.
In the matrix for XP 8.2, Solr 6.6.6 is also marked as compatible although with note "not officially tested, but expected to work".
I would definitely go with this option in your case. Solr is really strict about version numbering and there are definitely (a.k.a. shouldn't be :-)) no breaking changes between 6.6.2 and 6.6.6.
2 - Upgrading Solr to 6.6.6 shouldn't be that time consuming. You basically need to setup up new environment for Solr 6.6.6, create / populate Sitecore cores and do rebuild of indexes to this new environment from Sitecore. That's it.