Aller au contenu
en Se connecter
Non notée

CVE-2024-45216 Improper Authentication vulnerability in Apache Solr

Description

Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing. This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0. Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Solr 9.0 9.0.0 → < 9.7.0 9.7.0
Apache Solr 5.3 5.3.0 → < 8.11.4 8.11.4
Solr 9.0 9.0.0 → < 9.7.0 9.7.0
Solr 5.3 5.3.0 → < 8.11.4 8.11.4

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Solr

Les 24 CVE de Apache Solr →
CVE-2026-44825 Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0… 8.1 Élevée CVE-2026-22022 Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable… Non notée CVE-2026-22444 The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters,… Non notée CVE-2025-24814 Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use… Non notée
Suivre cette CVE