Apache Solr: ConfigSets created during a backup restore command are trusted implicitly (Apache Software Foundation Apache Solr)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.74 % · percentile 55 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Analyzed
Description
Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to "trusted" ConfigSets that may not have been created with an Authenticated request. "trusted" ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated & Authorized. This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization. Users are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise.
Weaknesses (CWE)
- CWE-1188 — Initialization of a Resource with an Insecure Default
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | CISA-ADP |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Advisories
- GHSA-h7w9-c5vx-x7j3 — Insecure Default Initialization of Resource vulnerability in Apache Solr
European references
- ENISA EUVD · EUVD-2024-3053
- GCVE · GCVE-0-2024-45217
CERT-FR advisories
- CERTFR-2025-AVI-0170 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0114 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*≥ 6.6.0 < 8.11.4cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.7.0
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache Solr | affected 6.6.0 < 8.11.4 ; affected 9.0.0 < 9.7.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |