CVE-2024-52012
Apache Solr: configset upload on Windows allows arbitrary path writes (zip slip)
Technology
Apache Solr
CVSS Score
5.4 / 10.0
Affected Versions
6.6 to 9.7.0
Upstream Fix
9.8.0
Published
January 27, 2025
OSSeva Coverage
Fixed upstream
Description
On Windows, the configset upload API does not sanitise file paths inside uploaded ZIP files, so a crafted archive can write files outside the intended directory. Rated moderate by the Solr PMC. Restricting the configset upload API to trusted administrators with the Rule-Based Authorization Plugin prevents it. Fixed in 9.8.0.
Is your Apache Solr deployment affected?
If you're running 6.6 to 9.7.0, you need this patch. Book a discovery call to get covered.
View Apache Solr coverage →Get a quote
Running Apache Solr 6.6 to 9.7.0?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?