Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.solr/solr-core@6.1.0
purl pkg:maven/org.apache.solr/solr-core@6.1.0
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score 10.0
Vulnerabilities affecting this package (30)
Advisory Summary Fixed in package version
CVE-2017-7660

Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create …
5.5.5
Vulnerable
6.6.5
Vulnerable
6.6.6
Vulnerable
7.1.0
Vulnerable
CVE-2017-3163

When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP …
5.5.5
Vulnerable
6.4.1
Vulnerable
6.6.5
Vulnerable
6.6.6
Vulnerable
7.1.0
Vulnerable
7.4.0
Vulnerable
7.7.1
Vulnerable
7.7.2
Vulnerable
7.7.3
Vulnerable
8.0.0
Vulnerable
8.2.0
Vulnerable
8.3.0
Vulnerable
8.4.0
Vulnerable
8.5.1
Vulnerable
8.5.2
Vulnerable
8.6.0
Vulnerable
CVE-2019-0192

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server …
6.6.6
Vulnerable
7.1.0
Vulnerable
7.4.0
Vulnerable
7.7.1
Vulnerable
8.0.0
Vulnerable
CVE-2017-3164

Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a …
6.6.6
Vulnerable
7.7.1
Vulnerable
7.7.2
Vulnerable
7.7.3
Vulnerable
8.0.0
Vulnerable
8.2.0
Vulnerable
8.3.0
Vulnerable
8.4.0
Vulnerable
8.5.1
Vulnerable
8.5.2
Vulnerable
8.6.0
Vulnerable
CVE-2018-11802

In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any …
6.6.6
Vulnerable
7.7.1
Vulnerable
7.7.2
Vulnerable
7.7.3
Vulnerable
8.0.0
Vulnerable
8.2.0
Vulnerable
8.3.0
Vulnerable
8.4.0
Vulnerable
GHSA-mh7g-99w9-xpjm
Aliases:
CVE-2017-12629
Remote code execution occurs in Apache Solr before versions 5.5.5, 6.6.2 and 7.1.0 by exploiting XXE in conjunction with use …
6.6.2
Vulnerable
GHSA-jgcr-fg3g-qvw8
Aliases:
CVE-2021-29262
Improper permission handling in Apache Solr When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider …
8.8.2
Vulnerable
GHSA-68r2-fwcg-qpm8
Aliases:
CVE-2025-24814
Apache Solr vulnerable to Execution with Unnecessary Privileges Core creation allows users to replace "trusted" configset files with arbitrary configuration …
9.8.0
Vulnerable
GHSA-j346-h5wc-rw2m
Aliases:
CVE-2018-11802
Incorrect Authorization in Apache Solr In Apache Solr, the cluster can be partitioned into multiple collections and only a subset …
6.6.6
Vulnerable
GHSA-3gm7-v7vw-866c
Aliases:
CVE-2019-0193
XML External Entity (XXE) Injection in Apache Solr In Apache Solr, the DataImportHandler, an optional but popular module to pull …
8.2.0
Vulnerable
GHSA-3hwc-rqwp-v36q
Aliases:
CVE-2023-50291
Apache Solr can leak certain passwords due to System Property redaction logic inconsistencies Insufficiently Protected Credentials vulnerability in Apache Solr. …
8.11.3
Vulnerable
GHSA-37vr-vmg4-jwpw
Aliases:
CVE-2023-50386
Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload …
8.11.3
Vulnerable
GHSA-qr3p-2xj2-q7hq
Aliases:
CVE-2026-22022
Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin Deployments of Apache Solr 5.3.0 through 9.10.0 that …
9.10.1
Vulnerable
CVE-2020-13941

Improper Input Validation The Replication handler allows commands `backup`, `restore` and `deleteBackup`. Each of these take a location parameter, which …
8.6.0
Vulnerable
CVE-2023-50298

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, …
8.11.3
Vulnerable
9.4.1
Vulnerable
CVE-2021-44548

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') An Improper Input Validation vulnerability in DataImportHandler of Apache …
8.11.1
Vulnerable
CVE-2021-29943

Incorrect Authorization When using `ConfigurableInternodeAuthHadoopPlugin` for authentication, Apache Solr would forward/proxy distributed requests using server credentials instead of original client …
8.8.2
Vulnerable
CVE-2017-9803

Privilege escalation Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication …
6.6.1
Vulnerable
CVE-2018-1308

XEE vulnerability via DIH's dataConfig request parameter This vulnerability relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` …
6.6.3
Vulnerable
7.3.0
Vulnerable
CVE-2021-27905

Server-Side Request Forgery (SSRF) The `ReplicationHandler` (normally registered at `/replication` under a Solr core) in Apache Solr has a `masterUrl` …
8.8.2
Vulnerable
CVE-2019-0192

Deserialization of Untrusted Data In Apache Solr versions, the Config API allows to configure the JMX server via an HTTP …
6.6.6
Vulnerable
GHSA-387v-84cv-9qmc
Aliases:
CVE-2017-3163
Improper Limitation of a Pathname ('Path Traversal') in org.apache.solr:solr-core When using the Index Replication feature, Apache Solr nodes can pull …
6.4.1
Vulnerable
6.4.1
Vulnerable
GHSA-7px3-6f6g-hxcj
Aliases:
CVE-2018-8026
XML external entity expansion in org.apache.solr:solr-core This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to …
6.6.5
Vulnerable
6.6.5
Vulnerable
GHSA-3pph-2595-cgfh
Aliases:
CVE-2018-1308
There is a XML external entity expansion (XXE) vulnerability in Apache Solr This vulnerability in Apache Solr 1.2 to 6.6.2 …
6.6.3
Vulnerable
6.6.3
Vulnerable
GHSA-c82r-qg3w-q5mv
Aliases:
CVE-2017-7660
Apache Solr insecure inter-node communication Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. …
6.6.0
Vulnerable
6.6.0
Vulnerable
CVE-2023-44487
Aliases:
GHSA-2m7v-gc89-fjqf
GHSA-qppj-fm5r-hxr3
GHSA-vx74-f528-fxqg
GHSA-xpw8-rcwv-8f8p
Uncontrolled Resource Consumption The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many …
9.4.0
Vulnerable
9.4.0
Vulnerable
CVE-2018-8010

Improper Restriction of XML External Entity Reference This vulnerability in Apache Solr relates to an XML external entity expansion (XXE) …
6.6.4
Vulnerable
7.3.1
Vulnerable
6.6.4
Vulnerable
7.3.1
Vulnerable
GHSA-vrh8-27q8-fr8f
Aliases:
CVE-2017-3164
Server-Side Request Forgery (SSRF) in org.apache.solr:solr-core Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the …
7.7.0
Vulnerable
7.7.0
Vulnerable
7.7.0
Vulnerable
GHSA-xhcq-fv7x-grr2
Aliases:
CVE-2019-0192
Critical severity vulnerability that affects org.apache.solr:solr-core In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API …
7.0.0
Vulnerable
7.0.0
Vulnerable
7.0.0
Vulnerable
GHSA-ww97-9w65-2crx
Aliases:
CVE-2019-17558
Improper Input Validation in Apache Solr Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution …
8.4.0
Vulnerable
8.4.0
Vulnerable
8.4.0
Vulnerable
8.4.0
Vulnerable
Vulnerabilities fixed by this package (4)

Advisory Summary Aliases
CVE-2012-6612
The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified …
CVE-2013-6407
The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data …
CVE-2019-12409
The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default …
CVE-2013-6408
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an …