VulnerableCode Package Details - pkg:maven/org.apache.solr/solr-core@5.4.0

Search for packages

Advisory	Summary	Fixed in package version
GHSA-jgcr-fg3g-qvw8 Aliases: CVE-2021-29262	Improper permission handling in Apache Solr When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider …	8.8.2 Vulnerable
GHSA-68r2-fwcg-qpm8 Aliases: CVE-2025-24814	Apache Solr vulnerable to Execution with Unnecessary Privileges Core creation allows users to replace "trusted" configset files with arbitrary configuration …	9.8.0 Vulnerable
GHSA-j346-h5wc-rw2m Aliases: CVE-2018-11802	Incorrect Authorization in Apache Solr In Apache Solr, the cluster can be partitioned into multiple collections and only a subset …	6.6.6 Vulnerable
GHSA-3gm7-v7vw-866c Aliases: CVE-2019-0193	XML External Entity (XXE) Injection in Apache Solr In Apache Solr, the DataImportHandler, an optional but popular module to pull …	8.2.0 Vulnerable
GHSA-qr3p-2xj2-q7hq Aliases: CVE-2026-22022	Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin Deployments of Apache Solr 5.3.0 through 9.10.0 that …	9.10.1 Vulnerable
CVE-2020-13941	Improper Input Validation The Replication handler allows commands `backup`, `restore` and `deleteBackup`. Each of these take a location parameter, which …	8.6.0 Vulnerable
CVE-2021-44548	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') An Improper Input Validation vulnerability in DataImportHandler of Apache …	8.11.1 Vulnerable
CVE-2021-29943	Incorrect Authorization When using `ConfigurableInternodeAuthHadoopPlugin` for authentication, Apache Solr would forward/proxy distributed requests using server credentials instead of original client …	8.8.2 Vulnerable
CVE-2017-9803	Privilege escalation Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication …	6.6.1 Vulnerable
CVE-2018-1308	XEE vulnerability via DIH's dataConfig request parameter This vulnerability relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` …	6.6.3 Vulnerable 7.3.0 Vulnerable
CVE-2021-27905	Server-Side Request Forgery (SSRF) The `ReplicationHandler` (normally registered at `/replication` under a Solr core) in Apache Solr has a `masterUrl` …	8.8.2 Vulnerable
CVE-2019-0192	Deserialization of Untrusted Data In Apache Solr versions, the Config API allows to configure the JMX server via an HTTP …	6.6.6 Vulnerable
GHSA-387v-84cv-9qmc Aliases: CVE-2017-3163	Improper Limitation of a Pathname ('Path Traversal') in org.apache.solr:solr-core When using the Index Replication feature, Apache Solr nodes can pull …	5.5.4 Vulnerable 5.5.4 Vulnerable
GHSA-3pph-2595-cgfh Aliases: CVE-2018-1308	There is a XML external entity expansion (XXE) vulnerability in Apache Solr This vulnerability in Apache Solr 1.2 to 6.6.2 …	6.6.3 Vulnerable 6.6.3 Vulnerable
GHSA-c82r-qg3w-q5mv Aliases: CVE-2017-7660	Apache Solr insecure inter-node communication Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. …	5.5.5 Vulnerable 5.5.5 Vulnerable
CVE-2023-44487 Aliases: GHSA-2m7v-gc89-fjqf GHSA-qppj-fm5r-hxr3 GHSA-vx74-f528-fxqg GHSA-xpw8-rcwv-8f8p	Uncontrolled Resource Consumption The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many …	9.4.0 Vulnerable 9.4.0 Vulnerable
GHSA-vrh8-27q8-fr8f Aliases: CVE-2017-3164	Server-Side Request Forgery (SSRF) in org.apache.solr:solr-core Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the …	7.7.0 Vulnerable 7.7.0 Vulnerable 7.7.0 Vulnerable
GHSA-xhcq-fv7x-grr2 Aliases: CVE-2019-0192	Critical severity vulnerability that affects org.apache.solr:solr-core In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API …	7.0.0 Vulnerable 7.0.0 Vulnerable 7.0.0 Vulnerable 7.0.0 Vulnerable 7.0.0 Vulnerable
GHSA-ww97-9w65-2crx Aliases: CVE-2019-17558	Improper Input Validation in Apache Solr Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution …	8.4.0 Vulnerable 8.4.0 Vulnerable 8.4.0 Vulnerable 8.4.0 Vulnerable 8.4.0 Vulnerable

Advisory

Summary

Fixed in package version

GHSA-jgcr-fg3g-qvw8
Aliases:
CVE-2021-29262

Improper permission handling in Apache Solr When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider …

8.8.2
Vulnerable

GHSA-68r2-fwcg-qpm8
Aliases:
CVE-2025-24814

Apache Solr vulnerable to Execution with Unnecessary Privileges Core creation allows users to replace "trusted" configset files with arbitrary configuration …

9.8.0
Vulnerable

GHSA-j346-h5wc-rw2m
Aliases:
CVE-2018-11802

Incorrect Authorization in Apache Solr In Apache Solr, the cluster can be partitioned into multiple collections and only a subset …

6.6.6
Vulnerable

GHSA-3gm7-v7vw-866c
Aliases:
CVE-2019-0193

XML External Entity (XXE) Injection in Apache Solr In Apache Solr, the DataImportHandler, an optional but popular module to pull …

8.2.0
Vulnerable

GHSA-qr3p-2xj2-q7hq
Aliases:
CVE-2026-22022

Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin Deployments of Apache Solr 5.3.0 through 9.10.0 that …

9.10.1
Vulnerable

CVE-2020-13941

Improper Input Validation The Replication handler allows commands `backup`, `restore` and `deleteBackup`. Each of these take a location parameter, which …

8.6.0
Vulnerable

CVE-2021-44548

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') An Improper Input Validation vulnerability in DataImportHandler of Apache …

8.11.1
Vulnerable

CVE-2021-29943

Incorrect Authorization When using `ConfigurableInternodeAuthHadoopPlugin` for authentication, Apache Solr would forward/proxy distributed requests using server credentials instead of original client …

8.8.2
Vulnerable

CVE-2017-9803

Privilege escalation Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication …

6.6.1
Vulnerable

CVE-2018-1308

XEE vulnerability via DIH's dataConfig request parameter This vulnerability relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` …

6.6.3
Vulnerable

7.3.0
Vulnerable

CVE-2021-27905

Server-Side Request Forgery (SSRF) The `ReplicationHandler` (normally registered at `/replication` under a Solr core) in Apache Solr has a `masterUrl` …

8.8.2
Vulnerable

CVE-2019-0192

Deserialization of Untrusted Data In Apache Solr versions, the Config API allows to configure the JMX server via an HTTP …

6.6.6
Vulnerable

GHSA-387v-84cv-9qmc
Aliases:
CVE-2017-3163

Improper Limitation of a Pathname ('Path Traversal') in org.apache.solr:solr-core When using the Index Replication feature, Apache Solr nodes can pull …

5.5.4
Vulnerable

GHSA-3pph-2595-cgfh
Aliases:
CVE-2018-1308

There is a XML external entity expansion (XXE) vulnerability in Apache Solr This vulnerability in Apache Solr 1.2 to 6.6.2 …

6.6.3
Vulnerable

GHSA-c82r-qg3w-q5mv
Aliases:
CVE-2017-7660

Apache Solr insecure inter-node communication Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. …

5.5.5
Vulnerable

CVE-2023-44487
Aliases:
GHSA-2m7v-gc89-fjqf
GHSA-qppj-fm5r-hxr3
GHSA-vx74-f528-fxqg
GHSA-xpw8-rcwv-8f8p

Uncontrolled Resource Consumption The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many …

9.4.0
Vulnerable

GHSA-vrh8-27q8-fr8f
Aliases:
CVE-2017-3164

Server-Side Request Forgery (SSRF) in org.apache.solr:solr-core Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the …

7.7.0
Vulnerable

GHSA-xhcq-fv7x-grr2
Aliases:
CVE-2019-0192

Critical severity vulnerability that affects org.apache.solr:solr-core In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API …

7.0.0
Vulnerable

GHSA-ww97-9w65-2crx
Aliases:
CVE-2019-17558

Improper Input Validation in Apache Solr Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution …

8.4.0
Vulnerable

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	10.0