Advisoriesby Ibis
Apache Solr security advisories
31 advisories · 3 critical or high in 12 months · latest Jun 1
31 advisories
Apache Solr has hardcoded credentials in the Basic Authentication setup toolCVE-2026-44825no fix yetApache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPluginCVE-2026-22022fixed in 9.10.1Apache Solr: Insufficient file-access checking in standalone core-creation requestsCVE-2026-22444fixed in 9.10.1Apache Solr Relative Path Traversal vulnerabilityCVE-2024-52012fixed in 9.8.0Apache Solr vulnerable to Execution with Unnecessary PrivilegesCVE-2025-24814fixed in 9.8.0Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSetsCVE-2023-50386fixed in 8.11.3 +1Apache Solr can leak certain passwords due to System Property redaction logic inconsistenciesCVE-2023-50291fixed in 8.11.3 +1Apache Solr Schema Designer blindly "trusts" all configsetsCVE-2023-50292fixed in 8.11.3 +1Apache Solr allows read access to host environmet variablesCVE-2023-50290fixed in 9.3.0Apache Solr vulnerable to XML BombCVE-2019-12401fixed in 5.0.0Improper Restriction of XML External Entity Reference in Apache SolrCVE-2012-6612fixed in 4.1.0XML Injection in Apache SolrCVE-2013-6408fixed in 4.3.1Apache Solr UpdateRequestHandler for XML resolves XML External EntitiesCVE-2013-6407fixed in 4.1.0Improper Limitation of a Pathname to a Restricted Directory in Apache SolrCVE-2013-6397fixed in 4.6.0Improper Neutralization of Input During Web Page Generation in Apache SolrCVE-2015-8795fixed in 5.1.0Improper Neutralization of Input During Web Page Generation in Apache SolrCVE-2015-8797fixed in 5.3.1Apache Solr insecure inter-node communicationCVE-2017-7660fixed in 5.5.5 +1Apache Solr Kerberos delegation token functionality flawsCVE-2017-9803fixed in 6.6.1Incorrect Authorization in Apache SolrCVE-2020-13957fixed in 8.6.3Incorrect Authorization in Apache SolrCVE-2018-11802fixed in 6.6.6 +1Improper permission handling in Apache SolrCVE-2021-29262fixed in 8.8.2Improper Input Validation in Apache SolrCVE-2019-17558fixed in 8.4.0Unrestricted upload of file with dangerous type in Apache SolrCVE-2019-12409fixed in 8.3.0XML External Entity (XXE) Injection in Apache SolrCVE-2019-0193fixed in 8.2.0Server-Side Request Forgery (SSRF) in org.apache.solr:solr-coreCVE-2017-3164fixed in 7.7.0Critical severity vulnerability that affects org.apache.solr:solr-coreCVE-2019-0192fixed in 7.0.0Improper Limitation of a Pathname ('Path Traversal') in org.apache.solr:solr-coreCVE-2017-3163fixed in 5.5.4 +1Remote code execution occurs in Apache SolrCVE-2017-12629fixed in 5.5.5 +2There is a XML external entity expansion (XXE) vulnerability in Apache Solr config filesCVE-2018-8010fixed in 6.6.4 +1There is a XML external entity expansion (XXE) vulnerability in Apache SolrCVE-2018-1308fixed in 6.6.3 +1XML external entity expansion in org.apache.solr:solr-coreCVE-2018-8026fixed in 6.6.5 +1