Login Request a demo
Critical severity · published Oct 16, 2024
CVE-2024-45216
Apache Solr: Authentication bypass possible using a fake URL Path ending
9.8
CVSS
92.7%
EPSS
No
On KEV
Description
Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing. This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0. Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)92.7% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Apache Solr · Apache Software Foundation
5.3.0 before 8.11.4; 9.0.0 before 9.7.0 · source: vendor
SO
Solr · Apache
5.3.0 before 8.11.4; 9.0.0 before 9.7.0 · source: NVD, CISA
Affected product
AS
Apache Solr
Apache Software Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45216
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45216
Vendor Advisory
https://solr.apache.org/security.html#cve-2024-45216-apache-solr-authentication-bypass-possible-using-a-fake-url-path-ending
Mailing List
http://www.openwall.com/lists/oss-security/2024/10/15/8
More from Apache Solr
9.8
CVE-2026-44825
Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
9.8
CVE-2019-0192
In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request
8.2
CVE-2026-22022
Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin
8.1
CVE-2024-45217
Apache Solr: ConfigSets created during a backup restore command are trusted implicitly
7.5
CVE-2017-3164
Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive)