Search for packages
| purl | pkg:maven/org.apache.solr/solr-core@8.2.0 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2019-12409
|
The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-13941
|
Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands … |
Vulnerable |
|
GHSA-jgcr-fg3g-qvw8
Aliases: CVE-2021-29262 |
Improper permission handling in Apache Solr When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider … |
Vulnerable |
|
GHSA-68r2-fwcg-qpm8
Aliases: CVE-2025-24814 |
Apache Solr vulnerable to Execution with Unnecessary Privileges Core creation allows users to replace "trusted" configset files with arbitrary configuration … |
Vulnerable |
|
GHSA-4p5m-gvpf-f3x5
Aliases: CVE-2024-52012 |
Apache Solr Relative Path Traversal vulnerability Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable … |
Vulnerable |
|
GHSA-3c7p-vv5r-cmr5
Aliases: CVE-2020-13957 |
Incorrect Authorization in Apache Solr Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some … |
Vulnerable |
|
GHSA-3hwc-rqwp-v36q
Aliases: CVE-2023-50291 |
Apache Solr can leak certain passwords due to System Property redaction logic inconsistencies Insufficiently Protected Credentials vulnerability in Apache Solr. … |
Vulnerable |
|
GHSA-37vr-vmg4-jwpw
Aliases: CVE-2023-50386 |
Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload … |
Vulnerable |
|
GHSA-qr3p-2xj2-q7hq
Aliases: CVE-2026-22022 |
Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin Deployments of Apache Solr 5.3.0 through 9.10.0 that … |
Vulnerable |
|
CVE-2020-13941
|
Improper Input Validation The Replication handler allows commands `backup`, `restore` and `deleteBackup`. Each of these take a location parameter, which … |
Vulnerable |
|
CVE-2023-50298
|
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, … |
Vulnerable Vulnerable |
|
CVE-2021-44548
|
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') An Improper Input Validation vulnerability in DataImportHandler of Apache … |
Vulnerable |
|
CVE-2021-29943
|
Incorrect Authorization When using `ConfigurableInternodeAuthHadoopPlugin` for authentication, Apache Solr would forward/proxy distributed requests using server credentials instead of original client … |
Vulnerable |
|
CVE-2021-27905
|
Server-Side Request Forgery (SSRF) The `ReplicationHandler` (normally registered at `/replication` under a Solr core) in Apache Solr has a `masterUrl` … |
Vulnerable |
|
CVE-2023-44487
Aliases: GHSA-2m7v-gc89-fjqf GHSA-qppj-fm5r-hxr3 GHSA-vx74-f528-fxqg GHSA-xpw8-rcwv-8f8p |
Uncontrolled Resource Consumption The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many … |
Vulnerable Vulnerable |
|
GHSA-ww97-9w65-2crx
Aliases: CVE-2019-17558 |
Improper Input Validation in Apache Solr Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution … |
Vulnerable Vulnerable |
|
GHSA-2289-pqfq-6wx7
Aliases: CVE-2019-12409 |
Unrestricted upload of file with dangerous type in Apache Solr The 8.1.1 and 8.2.0 releases of Apache Solr contain an … |
Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2017-9803
|
Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of … | |
|
CVE-2017-3163
|
When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP … | |
|
CVE-2017-12629
|
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with … | |
|
CVE-2018-8026
|
This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) … | |
|
CVE-2013-6408
|
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an … | |
|
CVE-2019-0193
|
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has … | |
|
CVE-2017-3164
|
Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a … | |
|
CVE-2018-11802
|
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any … | |
|
GHSA-3gm7-v7vw-866c
|
XML External Entity (XXE) Injection in Apache Solr In Apache Solr, the DataImportHandler, an optional but popular module to pull … |
CVE-2019-0193
|