Apache Solr: Authentication bypass possible using a fake URL Path ending (Apache Software Foundation Apache Solr)
At a glance
- Source
- NVD
- EPSS
- EPSS 92.75 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Analyzed
Description
Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing. This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0. Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Advisories
- GHSA-mjvf-4h88-6xm3 — Improper Authentication vulnerability in Apache Solr
European references
- ENISA EUVD · EUVD-2024-3084
- GCVE · GCVE-0-2024-45216
CERT-FR advisories
- CERTFR-2025-AVI-0170 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0114 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*≥ 5.3.0 < 8.11.4cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.7.0
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache Solr | affected 5.3.0 < 8.11.4 ; affected 9.0.0 < 9.7.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |