org.apache.solr:solr-core

4 results · Clear filters · Feed

• Critical 9.8
  CVE-2020-13957 Public exploit EPSS 79%

  Incorrect Authorization in Apache Solr

  Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. Th…

  org.apache.solr:solr-core org.apache.solr:solr-parent org.apache.solr:solr-solrj Maven
  Oct 13, 2020
• Critical 9.8
  CVE-2019-12409 Public exploit EPSS 22%

  Unrestricted upload of file with dangerous type in Apache Solr

  The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, the…

  Apache Solr org.apache.solr:solr-core Maven
  Nov 18, 2019
• Critical 9.8
  CVE-2019-0192 Public exploit Scanner template EPSS 78%

  Critical severity vulnerability that affects org.apache.solr:solr-core

  In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remot…

  Apache Software Foundation Apache Solr org.apache.solr:solr-core lucene-solr Ubuntu Maven
  Mar 7, 2019
• Critical 9.8
  CVE-2017-12629 Public exploit Scanner template EPSS 92%

  Remote code execution occurs in Apache Solr

  Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulner…

  org.apache.solr:solr-core lucene-solr lucene-solr Debian Ubuntu Maven
  Oct 14, 2017