SO
Product
Solr
On CISA KEVExploited in the wild
46
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 19Medium 10Low 1
Watch
Add Solr to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-17558 In wildKEV | 7.5 | Dec 30 | Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability Affected: 5.0.0 before 7.7.3; 8.0.0 before 8.4.0 |
| CVE-2019-0193 In wildKEV | 7.2 | Aug 1 | Apache Solr DataImportHandler Code Injection Vulnerability Affected: before 7.7.3; 8.1.0 before 8.1.2 |
| CVE-2023-50386 | 8.8 | Feb 9 | Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in… Affected: 6.0.0 before 8.11.3; 9.0.0 before 9.4.1 |
| CVE-2020-9492 | 8.8 | Jan 26 | In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification Affected: 8.6.0; 8.6.2 |
| CVE-2020-13941 | 8.8 | Aug 17 | Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0 Affected: before 8.6.0 |
| CVE-2026-22022 | 8.2 | Jan 21 | Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin Affected: 5.3.0 before 9.10.1 |
| CVE-2024-45217 | 8.1 | Oct 16 | Apache Solr: ConfigSets created during a backup restore command are trusted implicitly Affected: 6.6.0 before 8.11.4; 9.0.0 before 9.7.0 |
| CVE-2023-50298 | 7.5 | Feb 9 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1 Affected: 6.0.0 before 8.11.3; 9.0.0 before 9.4.1 |
| CVE-2023-50292 | 7.5 | Feb 9 | Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr Affected: 6.0.0 before 8.11.3; 9.0.0 before 9.4.1 |
| CVE-2023-50291 | 7.5 | Feb 9 | Insufficiently Protected Credentials vulnerability in Apache Solr Affected: 6.0.0 before 8.11.3; 9.0.0 before 9.3.0 |
| CVE-2021-33813 | 7.5 | Jun 16 | An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request Affected: 8.8.1; 8.9 |
| CVE-2021-29262 | 7.5 | Apr 13 | When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the… Affected: before 8.8.2 |
| CVE-2019-12401 | 7.5 | Sep 10 | Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a Affected: 1.3.0 through 1.4.1; 3.1 through 3.6.2; 4.0.0 through 4.10.4 |
| CVE-2017-3164 | 7.5 | Mar 8 | Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive) Affected: 1.3.0 through 7.6.0 |
| CVE-2018-1308 | 7.5 | Apr 9 | This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's… Affected: 1.2 through 6.6.2; 7.0.0 through 7.2.1 |
| CVE-2017-9803 | 7.5 | Sep 18 | Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application Affected: 6.2.0; 6.2.1; 6.3.0; 6.4.0; 6.4.1; 6.4.2; +3 more |
| CVE-2017-3163 | 7.5 | Aug 30 | When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name Affected: through 5.5.3; 6.0.0; 6.0.1; 6.1.0; 6.2.0; 6.2.1; +2 more |
| CVE-2017-7660 | 7.5 | Jul 7 | Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled Affected: 5.3.0; 5.3.1; 5.3.2; 5.4.0; 5.4.1; 5.5.0; +15 more |
| CVE-2026-22444 | 7.1 | Jan 21 | Apache Solr: Insufficient file-access checking in standalone core-creation requests Affected: 8.6.0 before 9.10.1 |
Showing 19