Every CVE Search/ Get API key

CVE-2024-45216

Apache Solr: Authentication bypass possible using a fake URL Path ending

9.8 CriticalPublic exploitFix available

Improper Authentication vulnerability in Apache Solr.

Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.

This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.

Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

92.7%Up 92.7 points since Oct 17, 2024
90%50%10%1%

What each source reports

CVE List Score used 9.8

Apache Solr: Authentication bypass possible using a fake URL Path ending

Improper Authentication vulnerability in Apache Solr.

Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.

This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.

Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.

Record
CVE-2024-45216
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287, CWE-863
Updated
2026-11-02
EUVDEUVD-2024-3084 9.8

Improper Authentication vulnerability in Apache Solr.

Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.

This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.

Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.

Record
EUVD-2024-3084
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-mjvf-4h88-6xm3 9.3

Improper Authentication vulnerability in Apache Solr

Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.

This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.

Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.

Record
GHSA-mjvf-4h88-6xm3
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287, CWE-863
Updated
2026-11-02
NVD 9.8

Improper Authentication vulnerability in Apache Solr.

Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.

This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.

Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.

Record
CVE-2024-45216
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287, CWE-863
Updated
2026-11-02
OSV 9.8

Apache Solr: Authentication bypass possible using a fake URL Path ending

Improper Authentication vulnerability in Apache Solr.

Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.

This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.

Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.

Record
CVE-2024-45216
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
OSVGHSA-mjvf-4h88-6xm3 9.3

Improper Authentication vulnerability in Apache Solr

Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.

This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.

Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.

Record
GHSA-mjvf-4h88-6xm3
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287, CWE-863
Updated
2026-11-02
OSVUBUNTU-CVE-2024-45216 9.8

Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing. This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0. Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.

Record
UBUNTU-CVE-2024-45216
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-solr-2024-45216 No score

Apache Solr: Authentication bypass possible using a fake URL Path ending

Improper Authentication vulnerability in Apache Solr.

Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.

This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.

Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.

Record
BIT-solr-2024-45216
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.solr:solr
Maven
 5.3.0 up to 8.11.4
8.11.4
org.apache.solr:solr
Maven
 9.0.0 up to 9.7.0
9.7.0
solr
Bitnami
 5.3.0 up to 8.11.4, 9.0.0 up to 9.7.0
8.11.49.7.0
lucene-solr
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
3.6.2+dfsg-13.6.2+dfsg-23.6.2+dfsg-2ubuntu0.1~esm13.6.2+dfsg-2ubuntu0.1~esm23.6.2+dfsg-2ubuntu0.1~esm4
 None known
lucene-solr
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.6.2+dfsg-73.6.2+dfsg-83.6.2+dfsg-8ubuntu0.13.6.2+dfsg-8ubuntu0.1+esm1
 None known
lucene-solr
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.6.2+dfsg-103.6.2+dfsg-113.6.2+dfsg-18~18.043.6.2+dfsg-18~18.04.1~esm2
 None known
lucene-solr
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.6.2+dfsg-203.6.2+dfsg-22
 None known
lucene-solr
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.6.2+dfsg-24
 None known
lucene-solr
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.6.2+dfsg-26
 None known
lucene-solr
Ubuntu:25.10
 All versions, plus listed versions
3.6.2+dfsg-26
 None known
lucene-solr
Ubuntu:26.10
 All versions, plus listed versions
3.6.2+dfsg-27
 None known
lucene-solr
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.6.2+dfsg-263.6.2+dfsg-27
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
NucleiApache Solr - Authentication Bypass
PoC in GitHubcongdong007/CVE-2024-45216-Poc2024-12-02

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-45216 is a critical vulnerability (CVSS 9.8) in Apache Solr, published October 16, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 92.7%, the 99th percentile. Fixed in org.apache.solr:solr 8.11.4.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open