SO
Product
Solr
On CISA KEVExploited in the wild
46
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 19Medium 10Low 1
Watch
Add Solr to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-17558 In wildKEV | 7.5 | Dec 30 | Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability Affected: 5.0.0 before 7.7.3; 8.0.0 before 8.4.0 |
| CVE-2019-0193 In wildKEV | 7.2 | Aug 1 | Apache Solr DataImportHandler Code Injection Vulnerability Affected: before 7.7.3; 8.1.0 before 8.1.2 |
| CVE-2023-50386 | 8.8 | Feb 9 | Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in… Affected: 6.0.0 before 8.11.3; 9.0.0 before 9.4.1 |
| CVE-2020-9492 | 8.8 | Jan 26 | In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification Affected: 8.6.0; 8.6.2 |
| CVE-2020-13941 | 8.8 | Aug 17 | Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0 Affected: before 8.6.0 |
| CVE-2026-22022 | 8.2 | Jan 21 | Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable to allowing unauthorized access to certain Solr APIs, due to… Affected: 5.3.0 before 9.10.1 |
| CVE-2024-45217 | 8.1 | Oct 16 | Insecure Default Initialization of Resource vulnerability in Apache Solr Affected: 6.6.0 before 8.11.4; 9.0.0 before 9.7.0 |
| CVE-2023-50298 | 7.5 | Feb 9 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1 Affected: 6.0.0 before 8.11.3; 9.0.0 before 9.4.1 |
| CVE-2023-50292 | 7.5 | Feb 9 | Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr Affected: 6.0.0 before 8.11.3; 9.0.0 before 9.4.1 |
| CVE-2023-50291 | 7.5 | Feb 9 | Insufficiently Protected Credentials vulnerability in Apache Solr Affected: 6.0.0 before 8.11.3; 9.0.0 before 9.3.0 |
| CVE-2021-33813 | 7.5 | Jun 16 | An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request Affected: 8.8.1; 8.9 |
| CVE-2021-29262 | 7.5 | Apr 13 | When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the… Affected: before 8.8.2 |
| CVE-2019-12401 | 7.5 | Sep 10 | Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a Affected: 1.3.0 through 1.4.1; 3.1 through 3.6.2; 4.0.0 through 4.10.4 |
| CVE-2017-3164 | 7.5 | Mar 8 | Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive) Affected: 1.3.0 through 7.6.0 |
| CVE-2018-1308 | 7.5 | Apr 9 | This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's… Affected: 1.2 through 6.6.2; 7.0.0 through 7.2.1 |
| CVE-2017-9803 | 7.5 | Sep 18 | Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application Affected: 6.2.0; 6.2.1; 6.3.0; 6.4.0; 6.4.1; 6.4.2; +3 more |
| CVE-2017-3163 | 7.5 | Aug 30 | When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name Affected: through 5.5.3; 6.0.0; 6.0.1; 6.1.0; 6.2.0; 6.2.1; +2 more |
| CVE-2017-7660 | 7.5 | Jul 7 | Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled Affected: 5.3.0; 5.3.1; 5.3.2; 5.4.0; 5.4.1; 5.5.0; +15 more |
| CVE-2026-22444 | 7.1 | Jan 21 | The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to… Affected: 8.6.0 before 9.10.1 |
Showing 19