CVE-2023-50386
Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with…
Technology
Apache Solr
CVSS Score
8.8 / 10.0
Affected Versions
>=6.0.0 <8.11.3; >=9.0.0 <9.4.1
Upstream Fix
See upstream advisory
Published
February 9, 2024
OSSeva Coverage
Fixed upstream
Description
Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. In the affected versions, Solr ConfigSets accepted Java jar and class files to be uploaded through the ConfigSets API. When backing up Solr Collections, these configSet files would be saved to disk when using the LocalFileSystemRepository (the default for backups). If the backup was saved to a directory that Solr uses in its ClassPath/ClassLoaders, then the jar and class f
Is your Apache Solr deployment affected?
If you're running >=6.0.0 <8.11.3; >=9.0.0 <9.4.1, you need this patch. Book a discovery call to get covered.
View Apache Solr coverage →Get a quote
Running Apache Solr >=6.0.0 <8.11.3; >=9.0.0 <9.4.1?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?