1611 matches found
The vulnerability of the application software interface for backup/restore services provided by the Apache Solr search server allows a hacker to execute arbitrary code within the system.
The vulnerability of the application programming interface for backup/restore services provided by the Apache Solr search server lies in the lack of restrictions on the loading of files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code within the system remotely...
Exploit for Improper Control of Dynamically-Managed Code Resources in Apache Solr
Apache-Solr-RCECVE-2023-50386POC Apache Solr Backup/Restor...
GHSA-RGGV-CV7R-MW98 vulnerabilities
Vulnerabilities for packages: solr...
CVE-2024-22201 vulnerabilities
Vulnerabilities for packages: solr...
CVE-2024-22201 vulnerabilities
Vulnerabilities for packages: solr...
Apache Solr Backup/Restore APIs RCE
Apache Solr from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1 is affected by an Unrestricted Upload of File with Dangerous Type vulnerability which can result in remote code execution in the context of the user running Apache Solr. When Apache Solr creates a Collection, it will use a specific...
The vulnerability of the /admin/info/properties component of the Apache Solr search server, which allows a hacker to disclose protected information
The vulnerability of the /admin/info/properties component of the Apache Solr search server is related to insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...
The vulnerability of the Solr software solution for enterprise resource planning by Apache OFBiz, which allows attackers to modify protected information
The vulnerability of the Solr software for enterprise resource planning software Apache OFBiz lies in the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker to remotely modify protected information...
Unrestricted File Upload
Apache Solr is vulnerable to Unrestricted File Upload. The vulnerability is due to the ConfigSets API accepting and uploading jar/class files without proper restriction of file type. When backing up Solr Collections, the configSet files will be saved to disk, but if the backup directory is includ...
Insufficiently Protected Credentials
Apache Solr is vulnerable to Insufficiently Protected Credentials. The vulnerability is caused due to system property redaction logic inconsistencies. This allows an attacker to access sensitive system properties, including credentials such as passwords or secret keys...
Missing Authorization
Apache Solr is vulnerable to Missing Authorization. The vulnerability is caused due to lack of authentication checks within the Schema Designer, allowing an attacker to load configSets without proper authentication, resulting in arbitrary code execution...
Sensitive Information Disclosure
Apache Solr is vulnerable to Sensitive Information Disclosure. The vulnerability is due to missing zkHost validation within the Solr Streaming Expressions feature, allowing users to extract data from other Solr Clouds by specifying an external ZooKeeper host, which results in the leakage of...
CVE-2023-50386
A flaw was found in Apache Solr. In the affected versions, ConfigSets accept uploading Java jar and class files through the ConfigSets API. When backing up Solr Collections, these ConfigSet files are saved to the disk when using the LocalFileSystemRepository the default for backups. If the backup...
CVE-2023-50298
A flaw was found in Apache Solr. Streaming Expressions allow users to extract data from other Solr Clouds using a "zkHost" parameter. When the original SolrCloud is set up to use ZooKeeper credentials and ACLs, they will be sent to whichever "zkHost" the user provides. An attacker could set up a...
CVE-2023-50292
A flaw was found in Apache Solr. The Schema Designer was introduced to allow users to more easily configure and test new Schemas and configSets. However, it may load untrusted configSets, which can allow an unauthenticated user to load external libraries when used in the Schema Designer. This iss...
CVE-2023-50291
A flaw was found in Apache Solr. The /admin/info/properties endpoint, which publishes the Solr process' Java system properties, is only setup to hide system properties that have "password" contained in the name. There are a number of sensitive system properties, such as "basicauth" and...
Apache Solr can leak certain passwords due to System Property redaction logic inconsistencies
Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...
GHSA-XRJ7-X7GP-WWQR Apache Solr's Streaming Expressions allow users to extract data from other Solr Clouds
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. This issue affects Apache Solr from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. Solr Streaming Expressions allows users to extract data from other Solr Clouds, using a "zkHost" parameter. When original...
Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets
Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. In the affected version...