SO
Product
Solr
On CISA KEVExploited in the wild
46
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 19Medium 10Low 1
Watch
Add Solr to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-17558 In wildKEV | 7.5 | Dec 30 | Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability Affected: 5.0.0 before 7.7.3; 8.0.0 before 8.4.0 |
| CVE-2019-0193 In wildKEV | 7.2 | Aug 1 | Apache Solr DataImportHandler Code Injection Vulnerability Affected: before 7.7.3; 8.1.0 before 8.1.2 |
| CVE-2026-44825 | 9.8 | Jun 1 | Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users Affected: 9.4.0 through 9.10.1; 10.0.0 |
| CVE-2024-45216 | 9.8 | Oct 16 | Apache Solr: Authentication bypass possible using a fake URL Path ending Affected: 5.3.0 before 8.11.4; 9.0.0 before 9.7.0 |
| CVE-2021-44548 | 9.8 | Dec 23 | An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from… Affected: before 8.11.1 |
| CVE-2021-27905 | 9.8 | Apr 13 | The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate… Affected: before 8.8.2 |
| CVE-2020-13957 | 9.8 | Oct 13 | Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured… Affected: 6.6.0 through 6.6.6; 7.0.0 through 7.7.3; 8.0.0 through 8.6.2 |
| CVE-2019-12409 | 9.8 | Nov 18 | The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping… Affected: 8.1.1; 8.2.0 |
| CVE-2019-0192 | 9.8 | Mar 7 | In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request Affected: 5.0.0 through 5.5.5; 6.0.0 through 6.6.5 |
| CVE-2017-12629 | 9.8 | Oct 14 | Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the… Affected: 5.5.0 through 5.5.4; 6.0.0 through 6.6.1; 7.0.0 through 7.0.1 |
| CVE-2021-29943 | 9.1 | Apr 13 | When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead… Affected: before 8.8.2 |
| CVE-2017-1000190 | 9.1 | Nov 17 | SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on Affected: 8.4.1 |
| CVE-2023-50386 | 8.8 | Feb 9 | Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in… Affected: 6.0.0 before 8.11.3; 9.0.0 before 9.4.1 |
| CVE-2020-9492 | 8.8 | Jan 26 | In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification Affected: 8.6.0; 8.6.2 |
| CVE-2020-13941 | 8.8 | Aug 17 | Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0 Affected: before 8.6.0 |
| CVE-2026-22022 | 8.2 | Jan 21 | Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin Affected: 5.3.0 before 9.10.1 |
| CVE-2024-45217 | 8.1 | Oct 16 | Apache Solr: ConfigSets created during a backup restore command are trusted implicitly Affected: 6.6.0 before 8.11.4; 9.0.0 before 9.7.0 |
| CVE-2023-50298 | 7.5 | Feb 9 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1 Affected: 6.0.0 before 8.11.3; 9.0.0 before 9.4.1 |
| CVE-2023-50292 | 7.5 | Feb 9 | Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr Affected: 6.0.0 before 8.11.3; 9.0.0 before 9.4.1 |
| CVE-2023-50291 | 7.5 | Feb 9 | Insufficiently Protected Credentials vulnerability in Apache Solr Affected: 6.0.0 before 8.11.3; 9.0.0 before 9.3.0 |
| CVE-2021-33813 | 7.5 | Jun 16 | An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request Affected: 8.8.1; 8.9 |
| CVE-2021-29262 | 7.5 | Apr 13 | When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the… Affected: before 8.8.2 |
| CVE-2019-12401 | 7.5 | Sep 10 | Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a Affected: 1.3.0 through 1.4.1; 3.1 through 3.6.2; 4.0.0 through 4.10.4 |
| CVE-2017-3164 | 7.5 | Mar 8 | Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive) Affected: 1.3.0 through 7.6.0 |
| CVE-2018-1308 | 7.5 | Apr 9 | This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's… Affected: 1.2 through 6.6.2; 7.0.0 through 7.2.1 |
| CVE-2017-9803 | 7.5 | Sep 18 | Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application Affected: 6.2.0; 6.2.1; 6.3.0; 6.4.0; 6.4.1; 6.4.2; +3 more |
| CVE-2017-3163 | 7.5 | Aug 30 | When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name Affected: through 5.5.3; 6.0.0; 6.0.1; 6.1.0; 6.2.0; 6.2.1; +2 more |
| CVE-2017-7660 | 7.5 | Jul 7 | Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled Affected: 5.3.0; 5.3.1; 5.3.2; 5.4.0; 5.4.1; 5.5.0; +15 more |
| CVE-2026-22444 | 7.1 | Jan 21 | Apache Solr: Insufficient file-access checking in standalone core-creation requests Affected: 8.6.0 before 9.10.1 |
| CVE-2023-50290 | 6.5 | Jan 15 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr Affected: 9.0.0 before 9.3.0 |
| CVE-2015-8797 | 6.1 | Feb 15 | Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 allows remote attackers to inject… Affected: through 5.3 |
| CVE-2015-8796 | 6.1 | Feb 15 | Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/schema-browser.js in the Admin UI in Apache Solr before 5.3 allows remote attackers to inject arbitrary web… Affected: through 5.2.1 |
| CVE-2015-8795 | 6.1 | Feb 15 | Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary web script or HTML via crafted fields that… Affected: through 5.0 |
| CVE-2025-24814 | 5.5 | Jan 27 | Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files Affected: before 9.8.0 |
| CVE-2018-8026 | 5.5 | Jul 5 | This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files (currency.xml, enumsConfig.xml referred… Affected: after 6.0.0 through 6.6.4; 7.0.0 through 7.3.1 |
| CVE-2018-8010 | 5.5 | May 21 | This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (solrconfig.xml, schema.xml,… Affected: 6.0.0 through 6.6.3; 7.0.0 through 7.3.0 |
| CVE-2024-52012 | 5.4 | Jan 27 | Apache Solr: Configset upload on Windows allows arbitrary path write-access Affected: 6.6.0 before 9.8.0 |
| CVE-2020-27223 | 5.3 | Feb 26 | In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of… Affected: 8.8.1 |
| CVE-2018-11802 | 4.3 | Apr 1 | In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection Affected: 4.2.0 before 6.6.6; 7.0.0 before 7.7.0 |
| CVE-2021-28163 | 2.7 | Apr 1 | In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory… Affected: 8.8.1 |
| CVE-2014-3628 | – | Jan 6 | Cross-site scripting (XSS) vulnerability in the Admin UI Plugin / Stats page in Apache Solr 4.x before 4.10.3 allows remote attackers to inject arbitrary web script or HTML via… Affected: 4.0.0; 4.0.0; 4.0.0; 4.1.0; 4.2.0; 4.2.1; +17 more |
| CVE-2012-6612 | – | Dec 7 | The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an… Affected: through 4.0.0; 4.0.0; 4.0.0 |
| CVE-2013-6408 | – | Dec 7 | The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML… Affected: through 4.3.0; 3.6.0; 3.6.1; 3.6.2; 4.0.0; 4.0.0; +4 more |
| CVE-2013-6407 | – | Dec 7 | The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in… Affected: through 4.0.0; 3.6.0; 3.6.1; 3.6.2; 4.0.0; 4.0.0 |
| CVE-2013-6397 | – | Dec 7 | Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a Affected: through 4.5.1; 4.0.0; 4.0.0; 4.0.0; 4.1.0; 4.2.0; +5 more |
| CVE-2009-3821 | – | Oct 28 | Cross-site scripting (XSS) vulnerability in the Apache Solr Search (solr) extension 1.0.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: 1.0.0 |
Showing 46