Read the docs
TI-2023-27504 Aliases CVE-2023-50292GHSA-4wxw-42wx-2wfx

Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users

Priority MEDIUM 44CWE-732Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0. The Schema Designer was introduced to allow users to more easily configure and test new Schemas and configSets. However, when the feature was created, the "trust" (authentication) of these configSets was not considered. External library loading is only available to configSets that are "trusted" (created by authenticated users), thus non-authenticated users are unable to perform Remote Code Execution. Since the Schema Designer loaded configSets without taking their "trust" into account, configSets that were created by unauthenticated users were allowed to load external libraries when used in the Schema Designer. Users are recommended to upgrade to version 9.3.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03024 87th percentileScored 2026-11-07
Fix Partial Apache Solr (Apache Software Foundation): 9.3.0org.apache.solr:solr-core (Maven): 9.3.0, 8.11.3Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Solr8.10.0 – 8.11.2; 9.0.0 to before 9.3.09.3.0Patch availableCNA
—org.apache.solr:solr-core (Maven)9.0.0 to before 9.3.09.3.0Patch availableGHSA-4wxw-42wx-2wfx
—org.apache.solr:solr-core (Maven)8.10.0 to before 8.11.38.11.3Patch availableGHSA-4wxw-42wx-2wfx
  • Apache Solr VendorApache Affected 8.10.0 – 8.11.2; 9.0.0 to before 9.3.0 Fixed in 9.3.0 Patch available CNA
  • org.apache.solr:solr-core (Maven) Vendor— Affected 9.0.0 to before 9.3.0 Fixed in 9.3.0 Patch available GHSA-4wxw-42wx-2wfx
  • org.apache.solr:solr-core (Maven) Vendor— Affected 8.10.0 to before 8.11.3 Fixed in 8.11.3 Patch available GHSA-4wxw-42wx-2wfx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*6.0.0 to before 8.11.3; 9.0.0 to before 9.4.1VulnerableApache
  • cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* Versions 6.0.0 to before 8.11.3; 9.0.0 to before 9.4.1 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Solr (Apache Software Foundation) Fixed in 9.3.0
  • Fix · GHSA-4wxw-42wx-2wfx org.apache.solr:solr-core (Maven) Fixed in 9.3.0 Advisory →
  • Fix · GHSA-4wxw-42wx-2wfx org.apache.solr:solr-core (Maven) Fixed in 8.11.3 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Solr 9.3.0

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2023-27503 Apache Solr: System Property redaction logic inconsistency can lead to leaked passwordsPriority MEDIUM 45
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Not affected: 3 products
  • Red Hat Data Grid 8
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Enterprise Application Platform 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-50292
  2. 2026-10-03 Alias added: GHSA-4wxw-42wx-2wfx

References

Advisory 2

Other 4

  • TI-2024-30303 Apache Solr: Authentication bypass possible using a fake URL Path ending CVSS 3.1CRITICAL 9.8
  • TI-2019-13101 Injection in Apache Solr KEVCVSS 3.1HIGH 7.5
  • TI-2019-00170 Code injection in Apache Solr KEVCVSS 3.1HIGH 7.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2021-09240 SSRF vulnerability with the Replication handler CVSS 3.1CRITICAL 9.8
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences