CVE-2024-52012 json
Apache Solr: Configset upload on Windows allows arbitrary path write-access
published 2025-01-27 21 mo ago modified 2026-09-10 1 mo ago also BIT-solr-2024-52012 , EUVD-2025-0133 , GHSA-4p5m-gvpf-f3x5
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 47.1%
- EPSS 47.1% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
Relative Path Traversal vulnerability in Apache Solr.
Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API. Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem. This issue affects Apache Solr: from 6.6 through 9.7.0.
Users are recommended to upgrade to version 9.8.0, which fixes the issue. Users unable to upgrade may also safely prevent the issue by using Solr's "Rule-Based Authentication Plugin" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users.
Patch / fix
- maven org.apache.solr:solr-core 9.8.0
- bitnami solr 9.8.0
- apache solr 9.8.0
- org.apache.solr solr-core 9.8.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
47.12% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| OSV | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.solr:solr-core | >=6.6, <9.8.0 |
9.8.0 |
| bitnami | solr | >=6.6.0, <9.8.0 |
9.8.0 |
Affected products
- Apache Software Foundation Apache Solr
Classification
- Weakness
-
- CWE-23 Relative Path Traversal
References
-
github.com
/apache/solr/commit/5795edd143b8fcb2ffaf7f278a099b8678adf396
web
-
lists.apache.org
/thread/yp39pgbv4vf1746pf5yblz84lv30vfxd
vendor-advisory, web, mailing-list, advisory
-
openwall.com
/lists/oss-security/2025/01/26/2
web, mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-52012
advisory, web
-
github.com
/apache/solr
package
-
issues.apache.org
/jira/browse/SOLR-17543
web
Sources
- CVE List CVE-2024-52012
- GitHub Advisory GHSA-4p5m-gvpf-f3x5
- NVD CVE-2024-52012
- OSV BIT-solr-2024-52012
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.