Debian Lucene-Solr vulnerabilities

CVE-2019-0193 [HIGH] CVE-2019-0193: lucene-solr - In Apache Solr, the DataImportHandler, an optional but popular module to pull in... In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scri

CVE-2023-50386 [HIGH] CVE-2023-50386: lucene-solr - Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of F... Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. In the affected versions, Solr ConfigSets accepted Java jar and class files to be uploade

CVE-2017-12629 [CRITICAL] CVE-2017-12629: lucene-solr - Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before... Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parse

CVE-2021-27905 [CRITICAL] CVE-2021-27905: lucene-solr - The ReplicationHandler (normally registered at "/replication" under a Solr core)... The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar conf

CVE-2013-6397 [MEDIUM] CVE-2013-6397: lucene-solr - Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.... Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to f

CVE-2018-1308 [HIGH] CVE-2018-1308: lucene-solr - This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an ... This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=` parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network. Scope: local bookworm: resolved (fixed in 3.6.2+dfsg

CVE-2020-13941 [HIGH] CVE-2020-13941: lucene-solr - Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in S... Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands backup, restore and deleteBackup. Each of these take a location parameter, which was not validated, i.e you could

CVE-2023-50292 [HIGH] CVE-2023-50292: lucene-solr - Incorrect Permission Assignment for Critical Resource, Improper Control of Dynam... Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0. The Schema Designer was introduced to allow users to more easily configure and test new Schemas and configSets. However, when the feature w

CVE-2017-3163 [HIGH] CVE-2017-3163: lucene-solr - When using the Index Replication feature, Apache Solr nodes can pull index files... When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path traversal, leaving any file readable to the Solr server process expose

CVE-2012-6612 [HIGH] CVE-2012-6612: lucene-solr - The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr... The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407. Scope: local bookworm: resolved (fixed

CVE-2023-50291 [HIGH] CVE-2023-50291: lucene-solr - Insufficiently Protected Credentials vulnerability in Apache Solr. This issue a... Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties that had "password" contained in the name. There are a number of s

CVE-2023-50298 [HIGH] CVE-2023-50298: lucene-solr - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. Solr Streaming Expressions allows users to extract data from other Solr Clouds, using a "zkHost" parameter. When original SolrCloud is setup to use ZooKeeper credentials and ACLs, they will be

CVE-2013-6408 [MEDIUM] CVE-2013-6408: lucene-solr - The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly... The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incom

CVE-2013-6407 [MEDIUM] CVE-2013-6407: lucene-solr - The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attacke... The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Scope: local bookworm: resolved (fixed in 3.6.2+dfsg-2) bullseye: resolved (fixed in 3.6.2+dfsg-2) forky: re

CVE-2025-24814 [MEDIUM] CVE-2025-24814: lucene-solr - Core creation allows users to replace "trusted" configset files with arbitrary c... Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" confi