Vulnerabilities > Apache > Solr > 4.7.1

DATE CVE VULNERABILITY TITLE RISK
2023-10-10 CVE-2023-44487 Resource Exhaustion vulnerability in multiple products
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
7.5
2021-12-23 CVE-2021-44548 Path Traversal vulnerability in Apache Solr
An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network.
network
apache CWE-22
6.8
2021-04-13 CVE-2021-29943 Incorrect Authorization vulnerability in Apache Solr
When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials.
network
low complexity
apache CWE-863
6.4
2021-04-13 CVE-2021-29262 Insufficiently Protected Credentials vulnerability in Apache Solr
When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable.
network
low complexity
apache CWE-522
7.5
2021-04-13 CVE-2021-27905 Server-Side Request Forgery (SSRF) vulnerability in Apache Solr
The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core.
network
low complexity
apache CWE-918
critical
9.8
2020-08-17 CVE-2020-13941 Improper Input Validation vulnerability in Apache Solr
Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0.
network
low complexity
apache CWE-20
8.8
2020-04-01 CVE-2018-11802 Incorrect Authorization vulnerability in Apache Solr
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection.
network
low complexity
apache CWE-863
4.0
2019-09-10 CVE-2019-12401 XML Entity Expansion vulnerability in Apache Solr
Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a.
network
low complexity
apache CWE-776
7.5
2019-08-01 CVE-2019-0193 Code Injection vulnerability in Apache Solr
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter.
network
low complexity
apache CWE-94
7.2
2019-03-08 CVE-2017-3164 Server-Side Request Forgery (SSRF) vulnerability in Apache Solr
Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive).
network
low complexity
apache CWE-918
7.5