VDB
CVE-2024-45216
CVE-2024-45216
PUBLISHED
CVSS 9.800000190734863 CRITICAL
Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing. This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0. Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
EPSS 92.75% · 99.8th percentile
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
92.75%
99.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | solr | 9.0.0, 5.3.0 |
| Bitnami | solr | 5.3.0, 9.0.0 |
Timeline
- Oct 15, 2024 CVE Published
- Oct 16, 2024 Coalition ESS Score
- Oct 17, 2024 EPSS Score
- Nov 5, 2024 EPSS Score
- Nov 23, 2024 EPSS Score
- Dec 2, 2024 VulnCheck XDB Entry
- Dec 13, 2024 EPSS Score
- Jan 1, 2025 EPSS Score
- Jan 10, 2025 VulnCheck XDB Entry
- Jan 20, 2025 EPSS Score
- Jan 25, 2025 Coalition ESS Score
- Feb 7, 2025 EPSS Score