org.apache.solr:solr-core vulnerabilities (Maven)

31 vulnerabilities.

• org.apache.solr:solr-core Maven Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users CVE-2026-44825 Public exploitFix available 8.1 HighJune 1, 2026
• org.apache.solr:solr-core Maven Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin CVE-2026-22022 Fix available 8.2 HighJanuary 21, 2026
• org.apache.solr:solr-core Maven Apache Solr: Insufficient file-access checking in standalone core-creation requests CVE-2026-22444 Public exploitFix available 7.1 HighJanuary 21, 2026
• org.apache.solr:solr-core Maven Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files CVE-2025-24814 Fix available 5.5 MediumJanuary 27, 2025
• org.apache.solr:solr-core Maven Apache Solr: Configset upload on Windows allows arbitrary path write-access CVE-2024-52012 Fix available EPSS 47.1% 5.4 MediumJanuary 27, 2025
• org.apache.solr:solr-core Maven Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords CVE-2023-50291 Fix available 7.5 HighFebruary 9, 2024
• org.apache.solr:solr-core Maven Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users CVE-2023-50292 Fix available 7.5 HighFebruary 9, 2024
• org.apache.solr:solr-core Maven Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets CVE-2023-50386 Public exploitFix available EPSS 83.7% 8.8 HighFebruary 9, 2024
• org.apache.solr:solr-core Maven Apache Solr: Host environment variables are published via the Metrics API CVE-2023-50290 Public exploitFix available EPSS 68.4% 6.5 MediumJanuary 15, 2024
• org.apache.solr:solr-core Maven Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings CVE-2021-29262 Fix available 7.5 HighApril 13, 2021
• org.apache.solr:solr-core Maven Incorrect Authorization in Apache Solr CVE-2020-13957 Public exploitFix available EPSS 79.3% 9.8 CriticalOctober 13, 2020
• org.apache.solr:solr-core Maven Incorrect Authorization in Apache Solr CVE-2018-11802 Fix available 4.3 MediumApril 1, 2020
• org.apache.solr:solr-core Maven Improper Input Validation in Apache Solr CVE-2019-17558 In KEVPublic exploitFix available EPSS 98.6% 7.5 HighDecember 30, 2019
• org.apache.solr:solr-core Maven Unrestricted upload of file with dangerous type in Apache Solr CVE-2019-12409 Public exploitFix available EPSS 21.6% 9.8 CriticalNovember 18, 2019
• org.apache.solr:solr-core Maven Apache Solr vulnerable to XML Bomb CVE-2019-12401 Public exploitFix available 7.5 HighSeptember 10, 2019
• org.apache.solr:solr-core Maven XML External Entity (XXE) Injection in Apache Solr CVE-2019-0193 In KEVPublic exploitFix available EPSS 83.5% 7.2 HighAugust 1, 2019
• org.apache.solr:solr-core Maven Server-Side Request Forgery (SSRF) in org.apache.solr:solr-core CVE-2017-3164 Public exploitFix available EPSS 19.4% 7.5 HighMarch 8, 2019
• org.apache.solr:solr-core Maven Critical severity vulnerability that affects org.apache.solr:solr-core CVE-2019-0192 Public exploitFix available EPSS 78.2% 9.8 CriticalMarch 7, 2019
• org.apache.solr:solr-core Maven XML external entity expansion in org.apache.solr:solr-core CVE-2018-8026 Fix available 5.5 MediumJuly 5, 2018
• org.apache.solr:solr-core Maven There is a XML external entity expansion (XXE) vulnerability in Apache Solr config files CVE-2018-8010 Fix available 5.5 MediumMay 21, 2018
• org.apache.solr:solr-core Maven There is a XML external entity expansion (XXE) vulnerability in Apache Solr CVE-2018-1308 Fix available EPSS 20.8% 7.5 HighApril 9, 2018
• org.apache.solr:solr-core Maven Remote code execution occurs in Apache Solr CVE-2017-12629 Public exploitFix available EPSS 91.9% 9.8 CriticalOctober 14, 2017
• org.apache.solr:solr-core Maven Apache Solr Kerberos delegation token functionality flaws CVE-2017-9803 Fix available 7.5 HighSeptember 18, 2017
• org.apache.solr:solr-core Maven Improper Limitation of a Pathname ('Path Traversal') in org.apache.solr:solr-core CVE-2017-3163 Fix available 7.5 HighJuly 30, 2017
• org.apache.solr:solr-core Maven Apache Solr insecure inter-node communication CVE-2017-7660 Fix available 7.5 HighJuly 7, 2017
• org.apache.solr:solr-core Maven Improper Neutralization of Input During Web Page Generation in Apache Solr CVE-2015-8797 Fix available 6.1 MediumFebruary 15, 2016
• org.apache.solr:solr-core Maven Improper Neutralization of Input During Web Page Generation in Apache Solr CVE-2015-8795 Fix available 6.1 MediumFebruary 15, 2016
• org.apache.solr:solr-core Maven Improper Restriction of XML External Entity Reference in Apache Solr CVE-2012-6612 Fix available EPSS 10.1% 7.5 HighDecember 7, 2013
• org.apache.solr:solr-core Maven XML Injection in Apache Solr CVE-2013-6408 Fix available EPSS 11.4% 6.4 MediumDecember 7, 2013
• org.apache.solr:solr-core Maven Apache Solr UpdateRequestHandler for XML resolves XML External Entities CVE-2013-6407 Fix available EPSS 11.4% 6.4 MediumDecember 7, 2013
• org.apache.solr:solr-core Maven Improper Limitation of a Pathname to a Restricted Directory in Apache Solr CVE-2013-6397 Fix available EPSS 56.5% 4.3 MediumDecember 7, 2013