PT-2025-5580 · Apache · Apache Solr

Pwn Null · Published 2025-01-26 · Updated 2025-01-29 · CVE-2025-24814

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Apache Solr versions up through 9.7

Description The issue allows users to replace "trusted" configset files with arbitrary configuration. Solr instances using the "FileSystemConfigSetService" component and running without authentication and authorization are affected. An attacker can exploit this to load malicious code as a searchComponent or other plugin by using "" tags to add to Solr's classpath.

Recommendations Apache Solr versions up through 9.7: Enable authentication and authorization on Solr clusters or switch to SolrCloud, and consider upgrading to Solr 9.8.0, which disables the use of "" tags by default.

Fix

Weakness Enumeration

CWE-250

Related Identifiers

BDU:2025-04325

BIT-SOLR-2025-24814

CVE-2025-24814

GHSA-68R2-FWCG-QPM8

Affected Products

Apache Solr

References · 29

• https://ubuntu.com/security/CVE-2025-24814 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-24814 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-68r2-fwcg-qpm8 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-24814 · Security Note
• https://lists.apache.org/thread/gl291pn8x9f9n52ys5l0pc0b6qtf0qw1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-solr-2025-24814 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24814 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-24814 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-24814 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04325 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24814 · Vendor Advisory
• https://github.com/apache/solr · Note
• https://github.com/apache/solr/commit/f492e24881c5724a1b1baecfc9549e2cb0257525 · Note
• https://twitter.com/fletch_ai/status/1884134450487005554 · Twitter Post
• https://twitter.com/CVEnew/status/1883806076472279191 · Twitter Post