Read the docs
TI-2023-27570 Aliases CVE-2023-50386GHSA-37vr-vmg4-jwpw

Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets

Priority HIGH 81CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-434.

Summary

Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. In the affected versions, Solr ConfigSets accepted Java jar and class files to be uploaded through the ConfigSets API. When backing up Solr Collections, these configSet files would be saved to disk when using the LocalFileSystemRepository (the default for backups). If the backup was saved to a directory that Solr uses in its ClassPath/ClassLoaders, then the jar and class files would be available to use with any ConfigSet, trusted or untrusted. When Solr is run in a secure way (Authorization enabled), as is strongly suggested, this vulnerability is limited to extending the Backup permissions with the ability to add libraries. Users are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the issue. In these versions, the following protections have been added: * Users are no longer able to upload files to a configSet that could be executed via a Java ClassLoader. * The Backup API restricts saving backups to directories that are used in the ClassLoader.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.83719 99th percentileScored 2026-11-07
Fix Fixed Apache Solr (Apache Software Foundation): 9.4.1org.apache.solr:solr-core (Maven): 8.11.3, 9.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Solr6.0.0 – 8.11.2; 9.0.0 to before 9.4.19.4.1Patch availableCNA
—org.apache.solr:solr-core (Maven)6.0.0 to before 8.11.38.11.3Patch availableGHSA-37vr-vmg4-jwpw
—org.apache.solr:solr-core (Maven)9.0.0 to before 9.4.19.4.1Patch availableGHSA-37vr-vmg4-jwpw
  • Apache Solr VendorApache Affected 6.0.0 – 8.11.2; 9.0.0 to before 9.4.1 Fixed in 9.4.1 Patch available CNA
  • org.apache.solr:solr-core (Maven) Vendor— Affected 6.0.0 to before 8.11.3 Fixed in 8.11.3 Patch available GHSA-37vr-vmg4-jwpw
  • org.apache.solr:solr-core (Maven) Vendor— Affected 9.0.0 to before 9.4.1 Fixed in 9.4.1 Patch available GHSA-37vr-vmg4-jwpw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*6.0.0 to before 8.11.3; 9.0.0 to before 9.4.1VulnerableApache
  • cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* Versions 6.0.0 to before 8.11.3; 9.0.0 to before 9.4.1 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Solr (Apache Software Foundation) Fixed in 9.4.1
  • Fix · GHSA-37vr-vmg4-jwpw org.apache.solr:solr-core (Maven) Fixed in 8.11.3 Advisory →
  • Fix · GHSA-37vr-vmg4-jwpw org.apache.solr:solr-core (Maven) Fixed in 9.4.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Solr 9.4.1

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2023-27507 Apache Solr: Solr can expose ZooKeeper credentials via Streaming ExpressionsPriority MEDIUM 42
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 5 products
  • Red Hat Data Grid 8
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-50386
  2. 2026-10-03 Alias added: GHSA-37vr-vmg4-jwpw

References

Advisory 2

Other 6

  • TI-2024-30303 Apache Solr: Authentication bypass possible using a fake URL Path ending CVSS 3.1CRITICAL 9.8
  • TI-2019-13101 Injection in Apache Solr KEVCVSS 3.1HIGH 7.5
  • TI-2019-00170 Code injection in Apache Solr KEVCVSS 3.1HIGH 7.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2021-09240 SSRF vulnerability with the Replication handler CVSS 3.1CRITICAL 9.8
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences