Skip to content
OpenAdvisories
High WID-SEC-2024-0340 4 CVEs

Apache Solr: Mehrere Schwachstellen

Published Feb 11, 2024 · Updated May 14, 2025 · Revision 4 · de-DE

Vendor: Apache Vendor: IBM Product: Operational Decision Manager Product: QRadar SIEM Product: Solr Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Solr ausnutzen, um Informationen offenzulegen oder beliebigen Programmcode auszuführen.

Product

Apache Solr ist ein Suchmaschinen-Server für Unternehmen mit einer REST-ähnlichen API.

Vulnerabilities 4

  • High 8.8
    CVE-2023-50386 Public exploit EPSS 84%

    Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets

    Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.…

    Apache Software Foundation Apache Solr org.apache.solr:solr-core lucene-solr Debian Maven
  • High 7.5
    CVE-2023-50291

    Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords

    Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, wa…

    Apache Software Foundation Apache Solr org.apache.solr:solr-core lucene-solr Debian Ubuntu Maven
  • High 7.5
    CVE-2023-50292

    Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users

    Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0. The Schema Designer was introduced…

    Apache Software Foundation Apache Solr org.apache.solr:solr-core lucene-solr Debian Maven
  • High 7.5
    CVE-2023-50298

    Apache Solr: Solr can expose ZooKeeper credentials via Streaming Expressions

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. Solr Streaming Expressions allows users to extract data from other Solr Clouds, using a…

    Apache Software Foundation Apache Solr druid lucene-solr Debian Wolfi Maven

Revision history

  1. #4

    Neue Updates von IBM aufgenommen

  2. #3

    Prüfung Produkteintragung

  3. #2

    Neue Updates von IBM aufgenommen

  4. #1

    Initiale Fassung

References