Apache Solr vulnerabilities

• apache solr Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users CVE-2026-44825 Public exploitFix available 8.1 HighJune 1, 2026
• apache solr Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin CVE-2026-22022 Fix available 8.2 HighJanuary 21, 2026
• apache solr Apache Solr: Insufficient file-access checking in standalone core-creation requests CVE-2026-22444 Public exploitFix available 7.1 HighJanuary 21, 2026
• apache solr Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files CVE-2025-24814 Fix available 5.5 MediumJanuary 27, 2025
• apache solr Apache Solr: Configset upload on Windows allows arbitrary path write-access CVE-2024-52012 Fix available EPSS 47.1% 5.4 MediumJanuary 27, 2025
• apache solr Apache Solr: ConfigSets created during a backup restore command are trusted implicitly CVE-2024-45217 Fix available 8.1 HighOctober 16, 2024
• apache solr Apache Solr: Authentication bypass possible using a fake URL Path ending CVE-2024-45216 Public exploitFix available EPSS 92.7% 9.8 CriticalOctober 16, 2024
• apache solr operator Apache Solr Operator: Solr-Operator liveness and readiness probes may leak basic auth credentials CVE-2024-31391 Fix available 6.5 MediumApril 12, 2024
• apache solr Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords CVE-2023-50291 Fix available 7.5 HighFebruary 9, 2024
• apache solr Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users CVE-2023-50292 Fix available 7.5 HighFebruary 9, 2024
• apache solr Apache Solr: Solr can expose ZooKeeper credentials via Streaming Expressions CVE-2023-50298 Fix available 7.5 HighFebruary 9, 2024
• apache solr Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets CVE-2023-50386 Public exploitFix available EPSS 83.7% 8.8 HighFebruary 9, 2024
• apache solr Apache Solr: Host environment variables are published via the Metrics API CVE-2023-50290 Public exploitFix available EPSS 68.4% 6.5 MediumJanuary 15, 2024
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• apache solr Apache Solr information disclosure vulnerability through DataImportHandler CVE-2021-44548 Fix available 9.8 CriticalDecember 23, 2021
• jdom, apache solr, tika +3 more +5 more XML External Entity (XXE) Injection in JDOM CVE-2021-33813 Fix available EPSS 19.4% 7.5 HighJune 16, 2021
• apache solr Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections CVE-2021-29943 Fix available 9.1 CriticalApril 13, 2021
• apache solr Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings CVE-2021-29262 Fix available 7.5 HighApril 13, 2021
• apache solr SSRF vulnerability with the Replication handler CVE-2021-27905 Public exploitFix available EPSS 93.1% 9.8 CriticalApril 13, 2021
• eclipse jetty, the eclipse foundation eclipse jetty, apache ignite +21 more +23 more Directory exposure in jetty CVE-2021-28163 Fix available 2.7 LowApril 1, 2021
• eclipse jetty, the eclipse foundation eclipse jetty, apache nifi +14 more +16 more DOS vulnerability for Quoted Quality CSV headers CVE-2020-27223 Public exploitFix available EPSS 78.0% 5.2 MediumFebruary 26, 2021
• apache hadoop, solr, oracle financial services crime and compliance management studio +2 more Improper Privilege Management in Apache Hadoop CVE-2020-9492 Fix available 8.8 HighJanuary 26, 2021
• apache solr Incorrect Authorization in Apache Solr CVE-2020-13957 Public exploitFix available EPSS 79.3% 9.8 CriticalOctober 13, 2020
• apache solr Improper Input Validation in Apache Solr CVE-2020-13941 Public exploitFix available 8.8 HighAugust 17, 2020
• apache solr Incorrect Authorization in Apache Solr CVE-2018-11802 Fix available 4.3 MediumApril 1, 2020
• apache solr, oracle primavera unifier +1 more Improper Input Validation in Apache Solr CVE-2019-17558 In KEVPublic exploitFix available EPSS 98.6% 7.5 HighDecember 30, 2019
• apache solr Unrestricted upload of file with dangerous type in Apache Solr CVE-2019-12409 Public exploitFix available EPSS 21.6% 9.8 CriticalNovember 18, 2019
• apache solr Apache Solr vulnerable to XML Bomb CVE-2019-12401 Public exploitFix available 7.5 HighSeptember 10, 2019
• apache solr, debian linux +1 more XML External Entity (XXE) Injection in Apache Solr CVE-2019-0193 In KEVPublic exploitFix available EPSS 83.5% 7.2 HighAugust 1, 2019
• apache solr Server-Side Request Forgery (SSRF) in org.apache.solr:solr-core CVE-2017-3164 Public exploitFix available EPSS 19.4% 7.5 HighMarch 8, 2019
• apache solr, netapp storage automation store +1 more Critical severity vulnerability that affects org.apache.solr:solr-core CVE-2019-0192 Public exploitFix available EPSS 78.2% 9.8 CriticalMarch 7, 2019
• apache solr, netapp snapcenter, storage automation store +2 more XML external entity expansion in org.apache.solr:solr-core CVE-2018-8026 Fix available 5.5 MediumJuly 5, 2018
• apache solr There is a XML external entity expansion (XXE) vulnerability in Apache Solr config files CVE-2018-8010 Fix available 5.5 MediumMay 21, 2018
• apache solr, debian linux +1 more There is a XML external entity expansion (XXE) vulnerability in Apache Solr CVE-2018-1308 Fix available EPSS 20.8% 7.5 HighApril 9, 2018
• simplexml project simplexml, apache solr +1 more SimpleXML has XML External Entity (XXE) vulnerability CVE-2017-1000190 Fix available 9.1 CriticalNovember 17, 2017
• apache solr, canonical ubuntu linux, debian linux +1 more +3 more Remote code execution occurs in Apache Solr CVE-2017-12629 Public exploitFix available EPSS 91.9% 9.8 CriticalOctober 14, 2017
• apache solr Apache Solr Kerberos delegation token functionality flaws CVE-2017-9803 Fix available 7.5 HighSeptember 18, 2017
• apache solr Improper Limitation of a Pathname ('Path Traversal') in org.apache.solr:solr-core CVE-2017-3163 Fix available 7.5 HighJuly 30, 2017
• apache solr Apache Solr insecure inter-node communication CVE-2017-7660 Fix available 7.5 HighJuly 7, 2017
• apache solr Improper Neutralization of Input During Web Page Generation in Apache Solr CVE-2015-8797 Fix available 6.1 MediumFebruary 15, 2016
• apache solr Apache Solr Cross-site scripting Vulnerability CVE-2015-8796 Fix available 6.1 MediumFebruary 15, 2016
• apache solr Improper Neutralization of Input During Web Page Generation in Apache Solr CVE-2015-8795 Fix available 6.1 MediumFebruary 15, 2016
• apache solr Improper Neutralization of Input During Web Page Generation in Apache Solr CVE-2014-3628 Fix available 4.3 MediumJanuary 6, 2015
• apache solr Improper Restriction of XML External Entity Reference in Apache Solr CVE-2012-6612 Fix available EPSS 10.1% 7.5 HighDecember 7, 2013
• apache solr XML Injection in Apache Solr CVE-2013-6408 Fix available EPSS 11.4% 6.4 MediumDecember 7, 2013
• apache solr Apache Solr UpdateRequestHandler for XML resolves XML External Entities CVE-2013-6407 Fix available EPSS 11.4% 6.4 MediumDecember 7, 2013
• apache solr Improper Limitation of a Pathname to a Restricted Directory in Apache Solr CVE-2013-6397 Fix available EPSS 56.5% 4.3 MediumDecember 7, 2013
• apache solr Apache Solr Search for TYPO3 vulnerable to Cross-site Scripting CVE-2009-3821 Fix available 4.3 MediumOctober 28, 2009