TI-2024-30303 Aliases CVE-2024-45216 GHSA-mjvf-4h88-6xm3

Apache Solr: Authentication bypass possible using a fake URL Path ending

CRITICAL 92CWE-287Published 2024-10-16 · Updated 2024-11-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing. This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0. Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.92747 99th percentileScored 2026-11-07

Fix Fixed Apache Solr (Apache Software Foundation): 8.11.4, 9.7.0org.apache.solr:solr (Maven): 8.11.4, 9.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Solr	5.3.0 to before 8.11.4; 9.0.0 to before 9.7.0	8.11.4, 9.7.0	Patch available	CNA
—	org.apache.solr:solr (Maven)	5.3.0 to before 8.11.4	8.11.4	Patch available	GHSA-mjvf-4h88-6xm3
—	org.apache.solr:solr (Maven)	9.0.0 to before 9.7.0	9.7.0	Patch available	GHSA-mjvf-4h88-6xm3

Apache Solr VendorApache Affected 5.3.0 to before 8.11.4; 9.0.0 to before 9.7.0 Fixed in 8.11.4, 9.7.0 Patch available CNA
org.apache.solr:solr (Maven) Vendor— Affected 5.3.0 to before 8.11.4 Fixed in 8.11.4 Patch available GHSA-mjvf-4h88-6xm3
org.apache.solr:solr (Maven) Vendor— Affected 9.0.0 to before 9.7.0 Fixed in 9.7.0 Patch available GHSA-mjvf-4h88-6xm3

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:solr::::::::	5.3.0 to before 8.11.4; 9.0.0 to before 9.7.0	Vulnerable	Apache

cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* Versions 5.3.0 to before 8.11.4; 9.0.0 to before 9.7.0 Vulnerable ·Apache

Remediation

Fix · CNA Apache Solr (Apache Software Foundation) Fixed in 8.11.4, 9.7.0
Fix · GHSA-mjvf-4h88-6xm3 org.apache.solr:solr (Maven) Fixed in 8.11.4 Advisory →
Fix · GHSA-mjvf-4h88-6xm3 org.apache.solr:solr (Maven) Fixed in 9.7.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-10-16
Apache Solr 8.11.4, 9.7.0
2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 LOW
Other records, highest priority first
- TI-2024-30304 Apache Solr: ConfigSets created during a backup restore command are trusted implicitlyPriority LOW 39
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-45216
2026-10-03 Alias added: GHSA-mjvf-4h88-6xm3

References

Advisory 2

Other 3

TI-2019-13101 Injection in Apache Solr KEVCVSS 3.1HIGH 7.5
TI-2019-00170 Code injection in Apache Solr KEVCVSS 3.1HIGH 7.2
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2021-09240 SSRF vulnerability with the Replication handler CVSS 3.1CRITICAL 9.8
TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
TI-2020-10933 Incorrect authorization in Apache Solr CVSS 3.1CRITICAL 9.8

See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences