CVE-2024-45217
Apache Solr: configsets created by a backup restore are trusted implicitly
Technology
Apache Solr
CVSS Score
8.1 / 10.0
Affected Versions
6.6.0 before 8.11.4; 9.0.0 before 9.7.0
Upstream Fix
8.11.4; 9.7.0
Published
October 16, 2024
OSSeva Coverage
Fixed upstream
Description
Configsets created by a restore command are written without the trusted metadata flag, and Solr treats a configset with no flag as trusted. A configset restored by an unauthenticated request can therefore load custom code. Instances secured with authentication and authorization are not affected. Rated moderate by the Solr PMC. Fixed in 8.11.4 and 9.7.0.
Is your Apache Solr deployment affected?
If you're running 6.6.0 before 8.11.4; 9.0.0 before 9.7.0, you need this patch. Book a discovery call to get covered.
View Apache Solr coverage →Get a quote
Running Apache Solr 6.6.0 before 8.11.4; 9.0.0 before 9.7.0?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?