SO
Product
Solr
On CISA KEVExploited in the wild
46
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 19Medium 10Low 1
Watch
Add Solr to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-17558 In wildKEV | 7.5 | Dec 30 | Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability Affected: 5.0.0 before 7.7.3; 8.0.0 before 8.4.0 |
| CVE-2019-0193 In wildKEV | 7.2 | Aug 1 | Apache Solr DataImportHandler Code Injection Vulnerability Affected: before 7.7.3; 8.1.0 before 8.1.2 |
| CVE-2026-44825 | 9.8 | Jun 1 | Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users Affected: 9.4.0 through 9.10.1; 10.0.0 |
| CVE-2024-45216 | 9.8 | Oct 16 | Improper Authentication vulnerability in Apache Solr Affected: 5.3.0 before 8.11.4; 9.0.0 before 9.7.0 |
| CVE-2021-44548 | 9.8 | Dec 23 | An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from… Affected: before 8.11.1 |
| CVE-2021-27905 | 9.8 | Apr 13 | The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate… Affected: before 8.8.2 |
| CVE-2020-13957 | 9.8 | Oct 13 | Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured… Affected: 6.6.0 through 6.6.6; 7.0.0 through 7.7.3; 8.0.0 through 8.6.2 |
| CVE-2019-12409 | 9.8 | Nov 18 | The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping… Affected: 8.1.1; 8.2.0 |
| CVE-2019-0192 | 9.8 | Mar 7 | In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request Affected: 5.0.0 through 5.5.5; 6.0.0 through 6.6.5 |
| CVE-2017-12629 | 9.8 | Oct 14 | Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the… Affected: 5.5.0 through 5.5.4; 6.0.0 through 6.6.1; 7.0.0 through 7.0.1 |
| CVE-2021-29943 | 9.1 | Apr 13 | When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead… Affected: before 8.8.2 |
| CVE-2017-1000190 | 9.1 | Nov 17 | SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on Affected: 8.4.1 |
| CVE-2023-50386 | 8.8 | Feb 9 | Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in… Affected: 6.0.0 before 8.11.3; 9.0.0 before 9.4.1 |
| CVE-2020-9492 | 8.8 | Jan 26 | In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification Affected: 8.6.0; 8.6.2 |
| CVE-2020-13941 | 8.8 | Aug 17 | Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0 Affected: before 8.6.0 |
| CVE-2026-22022 | 8.2 | Jan 21 | Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable to allowing unauthorized access to certain Solr APIs, due to… Affected: 5.3.0 before 9.10.1 |
| CVE-2024-45217 | 8.1 | Oct 16 | Insecure Default Initialization of Resource vulnerability in Apache Solr Affected: 6.6.0 before 8.11.4; 9.0.0 before 9.7.0 |
| CVE-2023-50298 | 7.5 | Feb 9 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1 Affected: 6.0.0 before 8.11.3; 9.0.0 before 9.4.1 |
| CVE-2023-50292 | 7.5 | Feb 9 | Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr Affected: 6.0.0 before 8.11.3; 9.0.0 before 9.4.1 |
| CVE-2023-50291 | 7.5 | Feb 9 | Insufficiently Protected Credentials vulnerability in Apache Solr Affected: 6.0.0 before 8.11.3; 9.0.0 before 9.3.0 |
| CVE-2021-33813 | 7.5 | Jun 16 | An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request Affected: 8.8.1; 8.9 |
| CVE-2021-29262 | 7.5 | Apr 13 | When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the… Affected: before 8.8.2 |
| CVE-2019-12401 | 7.5 | Sep 10 | Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a Affected: 1.3.0 through 1.4.1; 3.1 through 3.6.2; 4.0.0 through 4.10.4 |
| CVE-2017-3164 | 7.5 | Mar 8 | Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive) Affected: 1.3.0 through 7.6.0 |
| CVE-2018-1308 | 7.5 | Apr 9 | This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's… Affected: 1.2 through 6.6.2; 7.0.0 through 7.2.1 |
| CVE-2017-9803 | 7.5 | Sep 18 | Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application Affected: 6.2.0; 6.2.1; 6.3.0; 6.4.0; 6.4.1; 6.4.2; +3 more |
| CVE-2017-3163 | 7.5 | Aug 30 | When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name Affected: through 5.5.3; 6.0.0; 6.0.1; 6.1.0; 6.2.0; 6.2.1; +2 more |
| CVE-2017-7660 | 7.5 | Jul 7 | Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled Affected: 5.3.0; 5.3.1; 5.3.2; 5.4.0; 5.4.1; 5.5.0; +15 more |
| CVE-2026-22444 | 7.1 | Jan 21 | The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to… Affected: 8.6.0 before 9.10.1 |
| CVE-2023-50290 | 6.5 | Jan 15 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr Affected: 9.0.0 before 9.3.0 |
| CVE-2015-8797 | 6.1 | Feb 15 | Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 allows remote attackers to inject… Affected: through 5.3 |
| CVE-2015-8796 | 6.1 | Feb 15 | Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/schema-browser.js in the Admin UI in Apache Solr before 5.3 allows remote attackers to inject arbitrary web… Affected: through 5.2.1 |
| CVE-2015-8795 | 6.1 | Feb 15 | Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary web script or HTML via crafted fields that… Affected: through 5.0 |
| CVE-2025-24814 | 5.5 | Jan 27 | Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService" component (the default… Affected: before 9.8.0 |
| CVE-2018-8026 | 5.5 | Jul 5 | This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files (currency.xml, enumsConfig.xml referred… Affected: after 6.0.0 through 6.6.4; 7.0.0 through 7.3.1 |
| CVE-2018-8010 | 5.5 | May 21 | This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (solrconfig.xml, schema.xml,… Affected: 6.0.0 through 6.6.3; 7.0.0 through 7.3.0 |
| CVE-2024-52012 | 5.4 | Jan 27 | Relative Path Traversal vulnerability in Apache Solr Affected: 6.6.0 before 9.8.0 |
| CVE-2020-27223 | 5.3 | Feb 26 | In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of… Affected: 8.8.1 |
| CVE-2018-11802 | 4.3 | Apr 1 | In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection Affected: 4.2.0 before 6.6.6; 7.0.0 before 7.7.0 |
| CVE-2021-28163 | 2.7 | Apr 1 | In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory… Affected: 8.8.1 |
| CVE-2014-3628 | – | Jan 6 | Cross-site scripting (XSS) vulnerability in the Admin UI Plugin / Stats page in Apache Solr 4.x before 4.10.3 allows remote attackers to inject arbitrary web script or HTML via… Affected: 4.0.0; 4.0.0; 4.0.0; 4.1.0; 4.2.0; 4.2.1; +17 more |
| CVE-2012-6612 | – | Dec 7 | The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an… Affected: through 4.0.0; 4.0.0; 4.0.0 |
| CVE-2013-6408 | – | Dec 7 | The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML… Affected: through 4.3.0; 3.6.0; 3.6.1; 3.6.2; 4.0.0; 4.0.0; +4 more |
| CVE-2013-6407 | – | Dec 7 | The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in… Affected: through 4.0.0; 3.6.0; 3.6.1; 3.6.2; 4.0.0; 4.0.0 |
| CVE-2013-6397 | – | Dec 7 | Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a Affected: through 4.5.1; 4.0.0; 4.0.0; 4.0.0; 4.1.0; 4.2.0; +5 more |
| CVE-2009-3821 | – | Oct 28 | Cross-site scripting (XSS) vulnerability in the Apache Solr Search (solr) extension 1.0.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: 1.0.0 |
Showing 46