CVE-2024-45216 in the critical feed json
Apache Solr: Authentication bypass possible using a fake URL Path ending
published 2024-10-16 2 y ago modified 2026-09-08 2 mo ago also BIT-solr-2024-45216 , EUVD-2024-3084 , GHSA-mjvf-4h88-6xm3
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 92.7%
- EPSS 92.7% chance of exploitation in 30 days, percentile 99.8%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
Improper Authentication vulnerability in Apache Solr.
Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.
This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.
Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
Patch / fix
- maven org.apache.solr:solr 8.11.4, 9.7.0
- bitnami solr 8.11.4, 9.7.0
- Apache Software Foundation Apache Solr 8.11.4, 9.7.0
- apache solr 8.11.4, 9.7.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
92.75% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Apache Solr - Authentication Bypass nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.solr:solr | >=5.3.0, <8.11.4 >=9.0.0, <9.7.0 |
8.11.4 9.7.0 |
| bitnami | solr | >=5.3.0, <8.11.4 >=9.0.0, <9.7.0 |
8.11.4 9.7.0 |
Affected products
- Apache Software Foundation Apache Solr
- apache solr
Classification
References
-
solr.apache.org
/security.html#cve-2024-45216-apache-solr-authentication-bypass-possible-using-a-fake-url-path-ending
vendor-advisory, web, advisory
-
openwall.com
/lists/oss-security/2024/10/15/8
web, mailing-list, discussion
-
nvd.nist.gov
/vuln/detail/CVE-2024-45216
advisory, web
-
issues.apache.org
/jira/browse/SOLR-17417
web
-
svn.apache.org
/viewvc/lucene/dev/branches/branch_4x/solr/webapp
package
Sources
- CVE List CVE-2024-45216
- GitHub Advisory GHSA-mjvf-4h88-6xm3
- NVD CVE-2024-45216
- OSV BIT-solr-2024-45216
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.