Skip to content
OpenAdvisories

Package · Debian

lucene-solr

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.8
    CVE-2023-50386 Public exploit EPSS 84%

    Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets

    Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.…

    Apache Software Foundation Apache Solr org.apache.solr:solr-core lucene-solr Debian Maven
  • High 7.1
    CVE-2021-27905 Public exploit Scanner template EPSS 93%

    SSRF vulnerability with the Replication handler

    The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the loc…

    Apache Software Foundation Apache Solr lucene-solr lucene-solr Debian Ubuntu Maven
  • High 8.8
    CVE-2020-13941 Public exploit

    Improper Input Validation in Apache Solr

    Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands backup, r…

    lucene-solr lucene-solr org.apache.solr:solr-parent Debian Ubuntu Maven
  • High 7.5
    CVE-2019-17558 Exploited Public exploit Scanner template EPSS 99%

    Improper Input Validation in Apache Solr

    Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configse…

    org.apache.solr:solr-core lucene-solr Debian Maven
    KEV Nov 3, 2021
  • High 7.2
    CVE-2019-0193 Exploited Public exploit Scanner template EPSS 84%

    XML External Entity (XXE) Injection in Apache Solr

    In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen…

    Apache Apache Solr org.apache.solr:solr-core lucene-solr Debian Ubuntu Maven
    KEV Dec 10, 2021
  • High 7.5
    CVE-2017-3164 Public exploit EPSS 19%

    Server-Side Request Forgery (SSRF) in org.apache.solr:solr-core

    Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reac…

    Apache Software Foundation Apache Solr org.apache.solr:solr-core lucene-solr Debian Ubuntu Maven
  • Critical 9.8
    CVE-2017-12629 Public exploit Scanner template EPSS 92%

    Remote code execution occurs in Apache Solr

    Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulner…

    org.apache.solr:solr-core lucene-solr lucene-solr Debian Ubuntu Maven