VulnerableCode Package Details - pkg:maven/org.apache.solr/solr-core@3.1.0

Vulnerabilities affecting this package (25)

Advisory	Summary	Fixed in package version
GHSA-jgcr-fg3g-qvw8 Aliases: CVE-2021-29262	Improper permission handling in Apache Solr When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider …	8.8.2 Vulnerable
GHSA-68r2-fwcg-qpm8 Aliases: CVE-2025-24814	Apache Solr vulnerable to Execution with Unnecessary Privileges Core creation allows users to replace "trusted" configset files with arbitrary configuration …	9.8.0 Vulnerable
GHSA-j346-h5wc-rw2m Aliases: CVE-2018-11802	Incorrect Authorization in Apache Solr In Apache Solr, the cluster can be partitioned into multiple collections and only a subset …	6.6.6 Vulnerable
GHSA-6cpj-3g83-q2j4 Aliases: CVE-2012-6612	Improper Restriction of XML External Entity Reference in Apache Solr The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache …	4.1.0 Vulnerable
GHSA-45w3-2hvv-pfxq Aliases: CVE-2013-6408	XML Injection in Apache Solr The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows …	4.3.1 Vulnerable
GHSA-998j-j6v9-5846 Aliases: CVE-2013-6407	Apache Solr UpdateRequestHandler for XML resolves XML External Entities The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote …	4.1.0 Vulnerable
GHSA-j8qw-mwmv-28cg Aliases: CVE-2013-6397	Improper Limitation of a Pathname to a Restricted Directory in Apache Solr Directory traversal vulnerability in SolrResourceLoader in Apache Solr …	4.6.0 Vulnerable
GHSA-jq2w-w7v2-69q5 Aliases: CVE-2019-12401	Apache Solr vulnerable to XML Bomb Solr versions prior to 5.0.0 are vulnerable to an XML resource consumption attack (a.k.a. …	5.0.0 Vulnerable
GHSA-3gm7-v7vw-866c Aliases: CVE-2019-0193	XML External Entity (XXE) Injection in Apache Solr In Apache Solr, the DataImportHandler, an optional but popular module to pull …	8.2.0 Vulnerable
CVE-2020-13941	Improper Input Validation The Replication handler allows commands `backup`, `restore` and `deleteBackup`. Each of these take a location parameter, which …	8.6.0 Vulnerable
CVE-2021-44548	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') An Improper Input Validation vulnerability in DataImportHandler of Apache …	8.11.1 Vulnerable
CVE-2021-29943	Incorrect Authorization When using `ConfigurableInternodeAuthHadoopPlugin` for authentication, Apache Solr would forward/proxy distributed requests using server credentials instead of original client …	8.8.2 Vulnerable
CVE-2019-12401	Solr is vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via the update handler. By leveraging XML DOCTYPE …	5.0.0 Vulnerable
CVE-2013-6397	Directory traversal when loading XSL stylesheets and Velocity templates Directory traversal vulnerability in SolrResourceLoader in this package allows remote attackers …	5.0.0 Vulnerable 4.6.0 Vulnerable
CVE-2017-9803	Privilege escalation Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication …	6.6.1 Vulnerable
CVE-2018-1308	XEE vulnerability via DIH's dataConfig request parameter This vulnerability relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` …	6.6.3 Vulnerable 7.3.0 Vulnerable
CVE-2013-6407	XML eXternal Entity (XXE) flaw in XML and XSLT UpdateRequestHandler This package allows remote attackers to have an unspecified impact …	5.0.0 Vulnerable 4.6.0 Vulnerable
CVE-2013-6408	XML eXternal Entity (XXE) flaw in DocumentAnalysisRequestHandler The DocumentAnalysisRequestHandler in this package does not properly use the EmptyEntityResolver, which allows …	5.0.0 Vulnerable 4.6.0 Vulnerable
CVE-2021-27905	Server-Side Request Forgery (SSRF) The `ReplicationHandler` (normally registered at `/replication` under a Solr core) in Apache Solr has a `masterUrl` …	8.8.2 Vulnerable
GHSA-387v-84cv-9qmc Aliases: CVE-2017-3163	Improper Limitation of a Pathname ('Path Traversal') in org.apache.solr:solr-core When using the Index Replication feature, Apache Solr nodes can pull …	5.5.4 Vulnerable 5.5.4 Vulnerable
GHSA-3pph-2595-cgfh Aliases: CVE-2018-1308	There is a XML external entity expansion (XXE) vulnerability in Apache Solr This vulnerability in Apache Solr 1.2 to 6.6.2 …	6.6.3 Vulnerable 6.6.3 Vulnerable
GHSA-mx2h-hf7j-2x3p Aliases: CVE-2015-8795	Improper Neutralization of Input During Web Page Generation in Apache Solr Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI …	5.1.0 Vulnerable 5.1.0 Vulnerable
GHSA-v6gf-x8fp-532v Aliases: CVE-2015-8797	Improper Neutralization of Input During Web Page Generation in Apache Solr Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats …	5.3.1 Vulnerable 5.3.1 Vulnerable
CVE-2023-44487 Aliases: GHSA-2m7v-gc89-fjqf GHSA-qppj-fm5r-hxr3 GHSA-vx74-f528-fxqg GHSA-xpw8-rcwv-8f8p	Uncontrolled Resource Consumption The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many …	9.4.0 Vulnerable 9.4.0 Vulnerable
GHSA-vrh8-27q8-fr8f Aliases: CVE-2017-3164	Server-Side Request Forgery (SSRF) in org.apache.solr:solr-core Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the …	7.7.0 Vulnerable 7.7.0 Vulnerable 7.7.0 Vulnerable

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	10.0