CVE-2024-45217 json
Apache Solr: ConfigSets created during a backup restore command are trusted implicitly
published 2024-10-16 2 y ago modified 2026-09-08 2 mo ago also BIT-solr-2024-45217 , EUVD-2024-3053 , GHSA-h7w9-c5vx-x7j3
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
Insecure Default Initialization of Resource vulnerability in Apache Solr.
New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to "trusted" ConfigSets that may not have been created with an Authenticated request. "trusted" ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated & Authorized.
This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization.
Users are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise.
Patch / fix
- maven org.apache.solr:solr 8.11.4, 9.7.0
- bitnami solr 8.11.4, 9.7.0
- Apache Software Foundation Apache Solr 8.11.4, 9.7.0
- apache_software_foundation apache_solr 8.11.4, 9.7.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.75% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| OSV | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.solr:solr | >=6.6.0, <8.11.4 >=9.0.0, <9.7.0 |
8.11.4 9.7.0 |
| bitnami | solr | >=6.6.0, <8.11.4 >=9.0.0, <9.7.0 |
8.11.4 9.7.0 |
Affected products
- Apache Software Foundation Apache Solr
- apache_software_foundation apache_solr
Classification
- Weakness
-
- CWE-1188 Initialization of a Resource with an Insecure Default
References
-
solr.apache.org
/security.html#cve-2024-45217-apache-solr-configsets-created-during-a-backup-restore-command-are-trusted-impli
vendor-advisory, web, advisory
-
openwall.com
/lists/oss-security/2024/10/15/9
web, mailing-list, discussion
-
nvd.nist.gov
/vuln/detail/CVE-2024-45217
advisory, web
-
issues.apache.org
/jira/browse/SOLR-17418
web
-
svn.apache.org
/viewvc/lucene/dev/branches/branch_4x/solr/webapp
package
Sources
- CVE List CVE-2024-45217
- GitHub Advisory GHSA-h7w9-c5vx-x7j3
- NVD CVE-2024-45217
- OSV BIT-solr-2024-45217
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.