CVE-2025-24814
published 2025-01-27CVE-2025-24814: Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService"…
PriorityP432medium5.5CVSS 3.1
AVNACLPRLUIRSUCLILAL
EPSS
1.14%
63.0th percentile
Core creation allows users to replace "trusted" configset files with arbitrary configuration
Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem. These replacement config files are treated as "trusted" and can use "" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.
This issue affects all Apache Solr versions up through Solr 9.7. Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from "FileSystemConfigSetService"). Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of "" tags by default.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | solr | < 9.8.0 | 9.8.0 |
| apache_software_foundation | apache_solr | <= 9.7 | — |
| debian | lucene-solr | < lucene-solr 3.6.2+dfsg-23 (bookworm) | lucene-solr 3.6.2+dfsg-23 (bookworm) |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_oracle5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Communications Applications Risk Matrix: Core (Apache Solr) — CVE-2025-24814
vendor_oracle·2025-07-15·CVSS 5.4
CVE-2025-24814 [MEDIUM] Oracle Oracle Communications Applications Risk Matrix: Core (Apache Solr) — CVE-2025-24814
Oracle Oracle Communications Applications Risk Matrix: Core (Apache Solr) vulnerability
CVE: CVE-2025-24814
CVSS: 5.4
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2025 (JUL 2025)
Red Hat
solr: org.apache.solr: Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files
vendor_redhat·2025-01-27·CVSS 5.5
CVE-2025-24814 [MEDIUM] CWE-250 solr: org.apache.solr: Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files
solr: org.apache.solr: Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files
Core creation allows users to replace "trusted" configset files with arbitrary configuration
Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem. These replacement config files are treated as "trusted" and can use "" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.
This issue affects all
Debian
CVE-2025-24814: lucene-solr - Core creation allows users to replace "trusted" configset files with arbitrary c...
vendor_debian·2025·CVSS 5.5
CVE-2025-24814 [MEDIUM] CVE-2025-24814: lucene-solr - Core creation allows users to replace "trusted" configset files with arbitrary c...
Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem. These replacement config files are treated as "trusted" and can use "" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin. This issue affects all Apache Solr versions up through Solr 9.7. Users can protect against the vulnerability by enabling authenticati
OSV
CVE-2025-24814: Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetServi
osv·2025-01-27·CVSS 5.5
CVE-2025-24814 [MEDIUM] CVE-2025-24814: Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetServi
Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem. These replacement config files are treated as "trusted" and can use "" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin. This issue affects all Apache Solr versions up through Solr 9.7. Users can protect against the vulnerability by enabling authenticati
GHSA
Apache Solr vulnerable to Execution with Unnecessary Privileges
ghsa·2025-01-27
CVE-2025-24814 [HIGH] CWE-250 Apache Solr vulnerable to Execution with Unnecessary Privileges
Apache Solr vulnerable to Execution with Unnecessary Privileges
Core creation allows users to replace "trusted" configset files with arbitrary configuration
Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem. These replacement config files are treated as "trusted" and can use "" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.
This issue affects all Apache Solr versions up through Solr 9.7. U
OSV
Apache Solr vulnerable to Execution with Unnecessary Privileges
osv·2025-01-27
CVE-2025-24814 [HIGH] Apache Solr vulnerable to Execution with Unnecessary Privileges
Apache Solr vulnerable to Execution with Unnecessary Privileges
Core creation allows users to replace "trusted" configset files with arbitrary configuration
Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem. These replacement config files are treated as "trusted" and can use "" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.
This issue affects all Apache Solr versions up through Solr 9.7. U
No detection rules found.
No public exploits indexed.
2025-01-27
Published