[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZt1E3pL9gOhimdC_8OExJ7sV0f34OK1M0ZFDXw9Zz7A":3,"g5a-family:apache\u002Fsolr":511,"g5a-ex:apache\u002Fsolr@*":512},{"success":4,"data":5},true,{"product":6,"versions":282,"topVulnerabilitiesByEpss":414,"kevVulnerabilities":475,"seoMetadata":489,"meta":508},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":281},"apache","solr",131,40,3,"2024-02-09",[14,19,21,23,25,27,29,31,33,35,37,39,41,43,45,47,50,52,54,57,59,61,63,65,67,69,71,73,75,77,79,81,83,85,87,89,91,93,95,97,99,101,103,105,107,109,111,113,115,117,119,121,123,125,127,129,131,133,135,137,139,141,143,145,147,149,151,153,155,157,159,161,163,165,167,169,171,173,175,177,179,181,183,185,187,189,191,193,195,197,199,201,203,205,207,209,211,213,215,217,219,221,223,225,227,229,231,233,235,237,239,241,243,245,247,249,251,253,255,257,259,261,263,265,267,269,271,273,275,277,279],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},"1.0.0",1,0,false,{"version":20,"cve_count":17,"kev_count":17,"has_kev":18},"1.1.0",{"version":22,"cve_count":17,"kev_count":17,"has_kev":18},"1.2",{"version":24,"cve_count":17,"kev_count":17,"has_kev":18},"1.2.0",{"version":26,"cve_count":17,"kev_count":17,"has_kev":18},"1.3.0",{"version":28,"cve_count":17,"kev_count":17,"has_kev":18},"1.4.0",{"version":30,"cve_count":17,"kev_count":17,"has_kev":18},"1.4.1",{"version":32,"cve_count":17,"kev_count":17,"has_kev":18},"3.1",{"version":34,"cve_count":17,"kev_count":17,"has_kev":18},"3.1.0",{"version":36,"cve_count":17,"kev_count":17,"has_kev":18},"3.2",{"version":38,"cve_count":17,"kev_count":17,"has_kev":18},"3.2.0",{"version":40,"cve_count":17,"kev_count":17,"has_kev":18},"3.3",{"version":42,"cve_count":17,"kev_count":17,"has_kev":18},"3.3.0",{"version":44,"cve_count":17,"kev_count":17,"has_kev":18},"3.4.0",{"version":46,"cve_count":17,"kev_count":17,"has_kev":18},"3.5.0",{"version":48,"cve_count":49,"kev_count":17,"has_kev":18},"3.6.0",2,{"version":51,"cve_count":49,"kev_count":17,"has_kev":18},"3.6.1",{"version":53,"cve_count":49,"kev_count":17,"has_kev":18},"3.6.2",{"version":55,"cve_count":56,"kev_count":17,"has_kev":18},"4.0.0",5,{"version":58,"cve_count":11,"kev_count":17,"has_kev":18},"4.1.0",{"version":60,"cve_count":16,"kev_count":17,"has_kev":18},"4.10.0",{"version":62,"cve_count":16,"kev_count":17,"has_kev":18},"4.10.1",{"version":64,"cve_count":16,"kev_count":17,"has_kev":18},"4.10.2",{"version":66,"cve_count":17,"kev_count":17,"has_kev":18},"4.10.3",{"version":68,"cve_count":17,"kev_count":17,"has_kev":18},"4.10.4",{"version":70,"cve_count":11,"kev_count":17,"has_kev":18},"4.2.0",{"version":72,"cve_count":11,"kev_count":17,"has_kev":18},"4.2.1",{"version":74,"cve_count":49,"kev_count":17,"has_kev":18},"4.3.0",{"version":76,"cve_count":49,"kev_count":17,"has_kev":18},"4.3.1",{"version":78,"cve_count":49,"kev_count":17,"has_kev":18},"4.4.0",{"version":80,"cve_count":49,"kev_count":17,"has_kev":18},"4.5.0",{"version":82,"cve_count":16,"kev_count":17,"has_kev":18},"4.5.1",{"version":84,"cve_count":16,"kev_count":17,"has_kev":18},"4.6.0",{"version":86,"cve_count":16,"kev_count":17,"has_kev":18},"4.6.1",{"version":88,"cve_count":16,"kev_count":17,"has_kev":18},"4.7.0",{"version":90,"cve_count":16,"kev_count":17,"has_kev":18},"4.7.1",{"version":92,"cve_count":16,"kev_count":17,"has_kev":18},"4.7.2",{"version":94,"cve_count":16,"kev_count":17,"has_kev":18},"4.8.0",{"version":96,"cve_count":16,"kev_count":17,"has_kev":18},"4.8.1",{"version":98,"cve_count":16,"kev_count":17,"has_kev":18},"4.9.0",{"version":100,"cve_count":16,"kev_count":17,"has_kev":18},"4.9.1",{"version":102,"cve_count":17,"kev_count":17,"has_kev":18},"5.0",{"version":104,"cve_count":17,"kev_count":17,"has_kev":18},"5.0.0",{"version":106,"cve_count":17,"kev_count":17,"has_kev":18},"5.1",{"version":108,"cve_count":17,"kev_count":17,"has_kev":18},"5.1.0",{"version":110,"cve_count":17,"kev_count":17,"has_kev":18},"5.2.0",{"version":112,"cve_count":17,"kev_count":17,"has_kev":18},"5.2.1",{"version":114,"cve_count":17,"kev_count":17,"has_kev":18},"5.3",{"version":116,"cve_count":16,"kev_count":17,"has_kev":18},"5.3.0",{"version":118,"cve_count":16,"kev_count":17,"has_kev":18},"5.3.1",{"version":120,"cve_count":16,"kev_count":17,"has_kev":18},"5.3.2",{"version":122,"cve_count":16,"kev_count":17,"has_kev":18},"5.4.0",{"version":124,"cve_count":16,"kev_count":17,"has_kev":18},"5.4.1",{"version":126,"cve_count":16,"kev_count":17,"has_kev":18},"5.5.0",{"version":128,"cve_count":16,"kev_count":17,"has_kev":18},"5.5.1",{"version":130,"cve_count":16,"kev_count":17,"has_kev":18},"5.5.2",{"version":132,"cve_count":16,"kev_count":17,"has_kev":18},"5.5.3",{"version":134,"cve_count":16,"kev_count":17,"has_kev":18},"5.5.4",{"version":136,"cve_count":17,"kev_count":17,"has_kev":18},"5.5.5",{"version":138,"cve_count":49,"kev_count":17,"has_kev":18},"6.0.0",{"version":140,"cve_count":49,"kev_count":17,"has_kev":18},"6.0.1",{"version":142,"cve_count":49,"kev_count":17,"has_kev":18},"6.1.0",{"version":144,"cve_count":11,"kev_count":17,"has_kev":18},"6.2.0",{"version":146,"cve_count":11,"kev_count":17,"has_kev":18},"6.2.1",{"version":148,"cve_count":11,"kev_count":17,"has_kev":18},"6.3.0",{"version":150,"cve_count":11,"kev_count":17,"has_kev":18},"6.4.0",{"version":152,"cve_count":49,"kev_count":17,"has_kev":18},"6.4.1",{"version":154,"cve_count":49,"kev_count":17,"has_kev":18},"6.4.2",{"version":156,"cve_count":49,"kev_count":17,"has_kev":18},"6.5.0",{"version":158,"cve_count":49,"kev_count":17,"has_kev":18},"6.5.1",{"version":160,"cve_count":16,"kev_count":17,"has_kev":18},"6.6.0",{"version":162,"cve_count":17,"kev_count":17,"has_kev":18},"6.6.1",{"version":164,"cve_count":17,"kev_count":17,"has_kev":18},"6.6.2",{"version":166,"cve_count":17,"kev_count":17,"has_kev":18},"6.6.3",{"version":168,"cve_count":17,"kev_count":17,"has_kev":18},"6.6.4",{"version":170,"cve_count":17,"kev_count":17,"has_kev":18},"6.6.5",{"version":172,"cve_count":17,"kev_count":17,"has_kev":18},"6.6.6",{"version":174,"cve_count":17,"kev_count":17,"has_kev":18},"7.0.0",{"version":176,"cve_count":17,"kev_count":17,"has_kev":18},"7.0.1",{"version":178,"cve_count":17,"kev_count":17,"has_kev":18},"7.1.0",{"version":180,"cve_count":17,"kev_count":17,"has_kev":18},"7.2.0",{"version":182,"cve_count":17,"kev_count":17,"has_kev":18},"7.2.1",{"version":184,"cve_count":17,"kev_count":17,"has_kev":18},"7.3.0",{"version":186,"cve_count":17,"kev_count":17,"has_kev":18},"7.3.1",{"version":188,"cve_count":17,"kev_count":17,"has_kev":18},"7.4.0",{"version":190,"cve_count":17,"kev_count":17,"has_kev":18},"7.5.0",{"version":192,"cve_count":17,"kev_count":17,"has_kev":18},"7.6.0",{"version":194,"cve_count":17,"kev_count":17,"has_kev":18},"7.7.0",{"version":196,"cve_count":17,"kev_count":17,"has_kev":18},"7.7.1",{"version":198,"cve_count":17,"kev_count":17,"has_kev":18},"7.7.2",{"version":200,"cve_count":17,"kev_count":17,"has_kev":18},"7.7.3",{"version":202,"cve_count":17,"kev_count":17,"has_kev":18},"8.0.0",{"version":204,"cve_count":17,"kev_count":17,"has_kev":18},"8.1.0",{"version":206,"cve_count":17,"kev_count":17,"has_kev":18},"8.10.0",{"version":208,"cve_count":17,"kev_count":17,"has_kev":18},"8.10.1",{"version":210,"cve_count":16,"kev_count":17,"has_kev":18},"8.1.1",{"version":212,"cve_count":17,"kev_count":17,"has_kev":18},"8.11.0",{"version":214,"cve_count":17,"kev_count":17,"has_kev":18},"8.11.1",{"version":216,"cve_count":17,"kev_count":17,"has_kev":18},"8.11.2",{"version":218,"cve_count":17,"kev_count":17,"has_kev":18},"8.11.3",{"version":220,"cve_count":17,"kev_count":17,"has_kev":18},"8.11.4",{"version":222,"cve_count":17,"kev_count":17,"has_kev":18},"8.1.2",{"version":224,"cve_count":16,"kev_count":17,"has_kev":18},"8.2.0",{"version":226,"cve_count":17,"kev_count":17,"has_kev":18},"8.3.0",{"version":228,"cve_count":17,"kev_count":17,"has_kev":18},"8.3.1",{"version":230,"cve_count":17,"kev_count":17,"has_kev":18},"8.4.0",{"version":232,"cve_count":16,"kev_count":17,"has_kev":18},"8.4.1",{"version":234,"cve_count":17,"kev_count":17,"has_kev":18},"8.5.0",{"version":236,"cve_count":17,"kev_count":17,"has_kev":18},"8.5.1",{"version":238,"cve_count":17,"kev_count":17,"has_kev":18},"8.5.2",{"version":240,"cve_count":16,"kev_count":17,"has_kev":18},"8.6.0",{"version":242,"cve_count":17,"kev_count":17,"has_kev":18},"8.6.1",{"version":244,"cve_count":16,"kev_count":17,"has_kev":18},"8.6.2",{"version":246,"cve_count":17,"kev_count":17,"has_kev":18},"8.6.3",{"version":248,"cve_count":11,"kev_count":17,"has_kev":18},"8.8.1",{"version":250,"cve_count":17,"kev_count":17,"has_kev":18},"8.8.2",{"version":252,"cve_count":16,"kev_count":17,"has_kev":18},"8.9",{"version":254,"cve_count":17,"kev_count":17,"has_kev":18},"9.0.0",{"version":256,"cve_count":17,"kev_count":17,"has_kev":18},"9.1.0",{"version":258,"cve_count":17,"kev_count":17,"has_kev":18},"9.1.1",{"version":260,"cve_count":17,"kev_count":17,"has_kev":18},"9.2.0",{"version":262,"cve_count":17,"kev_count":17,"has_kev":18},"9.2.1",{"version":264,"cve_count":17,"kev_count":17,"has_kev":18},"9.3.0",{"version":266,"cve_count":17,"kev_count":17,"has_kev":18},"9.4.0",{"version":268,"cve_count":17,"kev_count":17,"has_kev":18},"9.4.1",{"version":270,"cve_count":17,"kev_count":17,"has_kev":18},"9.5.0",{"version":272,"cve_count":17,"kev_count":17,"has_kev":18},"9.6.0",{"version":274,"cve_count":17,"kev_count":17,"has_kev":18},"9.6.1",{"version":276,"cve_count":17,"kev_count":17,"has_kev":18},"9.7.0",{"version":278,"cve_count":17,"kev_count":17,"has_kev":18},"9.8.0",{"version":280,"cve_count":17,"kev_count":17,"has_kev":18},"9.8.1","Solr by Apache is a technology product with 131 tracked versions and 40 known security vulnerabilities including 3 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},{"version":20,"cve_count":17,"kev_count":17,"has_kev":18},{"version":22,"cve_count":17,"kev_count":17,"has_kev":18},{"version":24,"cve_count":17,"kev_count":17,"has_kev":18},{"version":26,"cve_count":17,"kev_count":17,"has_kev":18},{"version":28,"cve_count":17,"kev_count":17,"has_kev":18},{"version":30,"cve_count":17,"kev_count":17,"has_kev":18},{"version":32,"cve_count":17,"kev_count":17,"has_kev":18},{"version":34,"cve_count":17,"kev_count":17,"has_kev":18},{"version":36,"cve_count":17,"kev_count":17,"has_kev":18},{"version":38,"cve_count":17,"kev_count":17,"has_kev":18},{"version":40,"cve_count":17,"kev_count":17,"has_kev":18},{"version":42,"cve_count":17,"kev_count":17,"has_kev":18},{"version":44,"cve_count":17,"kev_count":17,"has_kev":18},{"version":46,"cve_count":17,"kev_count":17,"has_kev":18},{"version":48,"cve_count":49,"kev_count":17,"has_kev":18},{"version":51,"cve_count":49,"kev_count":17,"has_kev":18},{"version":53,"cve_count":49,"kev_count":17,"has_kev":18},{"version":55,"cve_count":56,"kev_count":17,"has_kev":18},{"version":58,"cve_count":11,"kev_count":17,"has_kev":18},{"version":60,"cve_count":16,"kev_count":17,"has_kev":18},{"version":62,"cve_count":16,"kev_count":17,"has_kev":18},{"version":64,"cve_count":16,"kev_count":17,"has_kev":18},{"version":66,"cve_count":17,"kev_count":17,"has_kev":18},{"version":68,"cve_count":17,"kev_count":17,"has_kev":18},{"version":70,"cve_count":11,"kev_count":17,"has_kev":18},{"version":72,"cve_count":11,"kev_count":17,"has_kev":18},{"version":74,"cve_count":49,"kev_count":17,"has_kev":18},{"version":76,"cve_count":49,"kev_count":17,"has_kev":18},{"version":78,"cve_count":49,"kev_count":17,"has_kev":18},{"version":80,"cve_count":49,"kev_count":17,"has_kev":18},{"version":82,"cve_count":16,"kev_count":17,"has_kev":18},{"version":84,"cve_count":16,"kev_count":17,"has_kev":18},{"version":86,"cve_count":16,"kev_count":17,"has_kev":18},{"version":88,"cve_count":16,"kev_count":17,"has_kev":18},{"version":90,"cve_count":16,"kev_count":17,"has_kev":18},{"version":92,"cve_count":16,"kev_count":17,"has_kev":18},{"version":94,"cve_count":16,"kev_count":17,"has_kev":18},{"version":96,"cve_count":16,"kev_count":17,"has_kev":18},{"version":98,"cve_count":16,"kev_count":17,"has_kev":18},{"version":100,"cve_count":16,"kev_count":17,"has_kev":18},{"version":102,"cve_count":17,"kev_count":17,"has_kev":18},{"version":104,"cve_count":17,"kev_count":17,"has_kev":18},{"version":106,"cve_count":17,"kev_count":17,"has_kev":18},{"version":108,"cve_count":17,"kev_count":17,"has_kev":18},{"version":110,"cve_count":17,"kev_count":17,"has_kev":18},{"version":112,"cve_count":17,"kev_count":17,"has_kev":18},{"version":114,"cve_count":17,"kev_count":17,"has_kev":18},{"version":116,"cve_count":16,"kev_count":17,"has_kev":18},{"version":118,"cve_count":16,"kev_count":17,"has_kev":18},{"version":120,"cve_count":16,"kev_count":17,"has_kev":18},{"version":122,"cve_count":16,"kev_count":17,"has_kev":18},{"version":124,"cve_count":16,"kev_count":17,"has_kev":18},{"version":126,"cve_count":16,"kev_count":17,"has_kev":18},{"version":128,"cve_count":16,"kev_count":17,"has_kev":18},{"version":130,"cve_count":16,"kev_count":17,"has_kev":18},{"version":132,"cve_count":16,"kev_count":17,"has_kev":18},{"version":134,"cve_count":16,"kev_count":17,"has_kev":18},{"version":136,"cve_count":17,"kev_count":17,"has_kev":18},{"version":138,"cve_count":49,"kev_count":17,"has_kev":18},{"version":140,"cve_count":49,"kev_count":17,"has_kev":18},{"version":142,"cve_count":49,"kev_count":17,"has_kev":18},{"version":144,"cve_count":11,"kev_count":17,"has_kev":18},{"version":146,"cve_count":11,"kev_count":17,"has_kev":18},{"version":148,"cve_count":11,"kev_count":17,"has_kev":18},{"version":150,"cve_count":11,"kev_count":17,"has_kev":18},{"version":152,"cve_count":49,"kev_count":17,"has_kev":18},{"version":154,"cve_count":49,"kev_count":17,"has_kev":18},{"version":156,"cve_count":49,"kev_count":17,"has_kev":18},{"version":158,"cve_count":49,"kev_count":17,"has_kev":18},{"version":160,"cve_count":16,"kev_count":17,"has_kev":18},{"version":162,"cve_count":17,"kev_count":17,"has_kev":18},{"version":164,"cve_count":17,"kev_count":17,"has_kev":18},{"version":166,"cve_count":17,"kev_count":17,"has_kev":18},{"version":168,"cve_count":17,"kev_count":17,"has_kev":18},{"version":170,"cve_count":17,"kev_count":17,"has_kev":18},{"version":172,"cve_count":17,"kev_count":17,"has_kev":18},{"version":174,"cve_count":17,"kev_count":17,"has_kev":18},{"version":176,"cve_count":17,"kev_count":17,"has_kev":18},{"version":178,"cve_count":17,"kev_count":17,"has_kev":18},{"version":180,"cve_count":17,"kev_count":17,"has_kev":18},{"version":182,"cve_count":17,"kev_count":17,"has_kev":18},{"version":184,"cve_count":17,"kev_count":17,"has_kev":18},{"version":186,"cve_count":17,"kev_count":17,"has_kev":18},{"version":188,"cve_count":17,"kev_count":17,"has_kev":18},{"version":190,"cve_count":17,"kev_count":17,"has_kev":18},{"version":192,"cve_count":17,"kev_count":17,"has_kev":18},{"version":194,"cve_count":17,"kev_count":17,"has_kev":18},{"version":196,"cve_count":17,"kev_count":17,"has_kev":18},{"version":198,"cve_count":17,"kev_count":17,"has_kev":18},{"version":200,"cve_count":17,"kev_count":17,"has_kev":18},{"version":202,"cve_count":17,"kev_count":17,"has_kev":18},{"version":204,"cve_count":17,"kev_count":17,"has_kev":18},{"version":206,"cve_count":17,"kev_count":17,"has_kev":18},{"version":208,"cve_count":17,"kev_count":17,"has_kev":18},{"version":210,"cve_count":16,"kev_count":17,"has_kev":18},{"version":212,"cve_count":17,"kev_count":17,"has_kev":18},{"version":214,"cve_count":17,"kev_count":17,"has_kev":18},{"version":216,"cve_count":17,"kev_count":17,"has_kev":18},{"version":218,"cve_count":17,"kev_count":17,"has_kev":18},{"version":220,"cve_count":17,"kev_count":17,"has_kev":18},{"version":222,"cve_count":17,"kev_count":17,"has_kev":18},{"version":224,"cve_count":16,"kev_count":17,"has_kev":18},{"version":226,"cve_count":17,"kev_count":17,"has_kev":18},{"version":228,"cve_count":17,"kev_count":17,"has_kev":18},{"version":230,"cve_count":17,"kev_count":17,"has_kev":18},{"version":232,"cve_count":16,"kev_count":17,"has_kev":18},{"version":234,"cve_count":17,"kev_count":17,"has_kev":18},{"version":236,"cve_count":17,"kev_count":17,"has_kev":18},{"version":238,"cve_count":17,"kev_count":17,"has_kev":18},{"version":240,"cve_count":16,"kev_count":17,"has_kev":18},{"version":242,"cve_count":17,"kev_count":17,"has_kev":18},{"version":244,"cve_count":16,"kev_count":17,"has_kev":18},{"version":246,"cve_count":17,"kev_count":17,"has_kev":18},{"version":248,"cve_count":11,"kev_count":17,"has_kev":18},{"version":250,"cve_count":17,"kev_count":17,"has_kev":18},{"version":252,"cve_count":16,"kev_count":17,"has_kev":18},{"version":254,"cve_count":17,"kev_count":17,"has_kev":18},{"version":256,"cve_count":17,"kev_count":17,"has_kev":18},{"version":258,"cve_count":17,"kev_count":17,"has_kev":18},{"version":260,"cve_count":17,"kev_count":17,"has_kev":18},{"version":262,"cve_count":17,"kev_count":17,"has_kev":18},{"version":264,"cve_count":17,"kev_count":17,"has_kev":18},{"version":266,"cve_count":17,"kev_count":17,"has_kev":18},{"version":268,"cve_count":17,"kev_count":17,"has_kev":18},{"version":270,"cve_count":17,"kev_count":17,"has_kev":18},{"version":272,"cve_count":17,"kev_count":17,"has_kev":18},{"version":274,"cve_count":17,"kev_count":17,"has_kev":18},{"version":276,"cve_count":17,"kev_count":17,"has_kev":18},{"version":278,"cve_count":17,"kev_count":17,"has_kev":18},{"version":280,"cve_count":17,"kev_count":17,"has_kev":18},[415,423,428,435,440,445,451,456,462,469],{"cveId":416,"description":417,"publishedDate":418,"cvssScore":419,"cvssVersion":420,"severity":421,"isKev":4,"epssScore":422},"CVE-2023-44487","The HTTP\u002F2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","2023-10-10",7.5,"v3.1","High",0.99999,{"cveId":424,"description":425,"publishedDate":426,"cvssScore":419,"cvssVersion":420,"severity":421,"isKev":4,"epssScore":427},"CVE-2019-17558","Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity\u002F` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).","2019-12-30",0.98567,{"cveId":429,"description":430,"publishedDate":431,"cvssScore":432,"cvssVersion":420,"severity":433,"isKev":18,"epssScore":434},"CVE-2021-27905","The ReplicationHandler (normally registered at \"\u002Freplication\" under a Solr core) in Apache Solr has a \"masterUrl\" (also \"leaderUrl\" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the \"shards\" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.","2021-04-13",9.8,"Critical",0.93053,{"cveId":436,"description":437,"publishedDate":438,"cvssScore":432,"cvssVersion":420,"severity":433,"isKev":18,"epssScore":439},"CVE-2017-12629","Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the \u002Fupload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.","2017-10-14",0.91896,{"cveId":441,"description":442,"publishedDate":12,"cvssScore":443,"cvssVersion":420,"severity":421,"isKev":18,"epssScore":444},"CVE-2023-50386","Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1.\n\nIn the affected versions, Solr ConfigSets accepted Java jar and class files to be uploaded through the ConfigSets API.\nWhen backing up Solr Collections, these configSet files would be saved to disk when using the LocalFileSystemRepository (the default for backups).\nIf the backup was saved to a directory that Solr uses in its ClassPath\u002FClassLoaders, then the jar and class files would be available to use with any ConfigSet, trusted or untrusted.\n\nWhen Solr is run in a secure way (Authorization enabled), as is strongly suggested, this vulnerability is limited to extending the Backup permissions with the ability to add libraries.\nUsers are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the issue.\nIn these versions, the following protections have been added:\n\n  *  Users are no longer able to upload files to a configSet that could be executed via a Java ClassLoader.\n  *  The Backup API restricts saving backups to directories that are used in the ClassLoader.",8.8,0.83719,{"cveId":446,"description":447,"publishedDate":448,"cvssScore":449,"cvssVersion":420,"severity":421,"isKev":4,"epssScore":450},"CVE-2019-0193","In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's \"dataConfig\" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging \u002F development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property \"enable.dih.dataConfigParam\" to true.","2019-08-01",7.2,0.83547,{"cveId":452,"description":453,"publishedDate":454,"cvssScore":432,"cvssVersion":420,"severity":433,"isKev":18,"epssScore":455},"CVE-2020-13957","Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication\u002Fauthorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD\u002FCREATE actions.","2020-10-13",0.79342,{"cveId":457,"description":458,"publishedDate":459,"cvssScore":432,"cvssVersion":460,"severity":433,"isKev":18,"epssScore":461},"CVE-2019-0192","In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.","2019-03-07","v3.0",0.78227,{"cveId":463,"description":464,"publishedDate":465,"cvssScore":466,"cvssVersion":420,"severity":467,"isKev":18,"epssScore":468},"CVE-2020-27223","In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.","2021-02-26",5.2,"Medium",0.78031,{"cveId":470,"description":471,"publishedDate":472,"cvssScore":473,"cvssVersion":420,"severity":467,"isKev":18,"epssScore":474},"CVE-2023-50290","Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.\nThe Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess.\n\nThe Solr Metrics API is protected by the \"metrics-read\" permission.\nTherefore, Solr Clouds with Authorization setup will only be vulnerable via users with the \"metrics-read\" permission.\nThis issue affects Apache Solr: from 9.0.0 before 9.3.0.\n\nUsers are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.\n\n","2024-01-15",6.5,0.68446,[476,480,485],{"cveId":416,"description":417,"publishedDate":418,"cvssScore":419,"severity":421,"isKev":4,"epssScore":422,"cisaVulnName":477,"cisaDateAdded":418,"cisaShortDescription":478,"cisaRequiredAction":479},"HTTP\u002F2 Rapid Reset Attack Vulnerability","HTTP\u002F2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":446,"description":447,"publishedDate":448,"cvssScore":449,"severity":421,"isKev":4,"epssScore":450,"cisaVulnName":481,"cisaDateAdded":482,"cisaShortDescription":483,"cisaRequiredAction":484},"Apache Solr DataImportHandler Code Injection Vulnerability","2021-12-10","The optional Apache Solr module DataImportHandler contains a code injection vulnerability.","Apply updates per vendor instructions.",{"cveId":424,"description":425,"publishedDate":426,"cvssScore":419,"severity":421,"isKev":4,"epssScore":427,"cisaVulnName":486,"cisaDateAdded":487,"cisaShortDescription":488,"cisaRequiredAction":484},"Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability","2021-11-03","The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution.",{"title":490,"metaDescription":491,"keywords":492,"structuredData":493},"Solr by Apache - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Solr by Apache covering 131 versions with 40 tracked vulnerabilities including 0 critical and 3 high-severity issues and 3 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Solr vulnerabilities, Solr security, Solr CVE, Apache Solr, Solr threat intelligence, Apache security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Solr KEV, Solr exploited vulnerabilities",{"@context":494,"@type":495,"name":496,"description":491,"url":497,"manufacturer":498,"applicationCategory":502,"softwareVersion":503,"mainEntity":504},"https:\u002F\u002Fschema.org","SoftwareApplication","Solr","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fapache\u002Fsolr",{"@type":499,"name":500,"url":501},"Organization","Apache","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fapache","Security Software","131 versions tracked",{"@type":505,"name":506,"description":507,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Solr Security Vulnerabilities","Security vulnerabilities affecting Solr by Apache",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":509,"apiVersion":510},"2026-10-18T16:36:25.188Z","3.0",[],{"rows":513,"total":11,"capped":18,"failed":17},[514,519,525],{"cveId":416,"name":477,"severity":421,"cvss":419,"added":418,"epss":422,"published":515,"ranges":516,"checked":4,"hits":518,"covers":18},"2023-10-10T14:15:10.883",[517],"before 9.4.0",[],{"cveId":446,"name":481,"severity":421,"cvss":449,"added":482,"epss":450,"published":520,"ranges":521,"checked":4,"hits":524,"covers":18},"2019-08-01T14:15:13.113",[522,523],"before 7.7.3","8.1.0 to before 8.1.2",[],{"cveId":424,"name":486,"severity":421,"cvss":419,"added":487,"epss":427,"published":526,"ranges":527,"checked":4,"hits":530,"covers":18},"2019-12-30T17:15:19.78",[528,529],"5.0.0 to before 7.7.3","8.0.0 to before 8.4.0",[]]