https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 21:18:34 +0000 https://cve.radiocsirt.org/vuln/bit-solr-2024-45217 <p><strong>Affected:</strong> Bitnami: solr</p> <p>Insecure Default Initialization of Resource vulnerability in Apache Solr.</p> <p>New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the &#34;trusted&#34; metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to &#34;trusted&#34; ConfigSets that may not have been created with an Authenticated request. &#34;trusted&#34; ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated &amp; Authorized.</p> <p>This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization.</p> <p>Users are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise.</p> <p><strong>Affected:</strong> Bitnami: solr</p> <p>Insecure Default Initialization of Resource vulnerability in Apache Solr.</p> <p>New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the &#34;trusted&#34; metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to &#34;trusted&#34; ConfigSets that may not have been created with an Authenticated request. &#34;trusted&#34; ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated &amp; Authorized.</p> <p>This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization.</p> <p>Users are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise.</p> https://cve.radiocsirt.org/vuln/bit-solr-2024-45217 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0114 certfr-2025-avi-0114 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0114 https://cve.radiocsirt.org/vuln/cnvd-2024-49159 cnvd-2024-49159 https://cve.radiocsirt.org/vuln/cnvd-2024-49159 https://cve.radiocsirt.org/vuln/euvd-2026-195995 EUVD-2026-195995 https://cve.radiocsirt.org/vuln/euvd-2026-195995 https://cve.radiocsirt.org/vuln/fkie_cve-2024-45217 <p>Insecure Default Initialization of Resource vulnerability in Apache Solr.</p> <p>New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the &#34;trusted&#34; metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to &#34;trusted&#34; ConfigSets that may not have been created with an Authenticated request. &#34;trusted&#34; ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated &amp; Authorized.</p> <p>This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization.</p> <p>Users are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise.</p> <p>Insecure Default Initialization of Resource vulnerability in Apache Solr.</p> <p>New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the &#34;trusted&#34; metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to &#34;trusted&#34; ConfigSets that may not have been created with an Authenticated request. &#34;trusted&#34; ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated &amp; Authorized.</p> <p>This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization.</p> <p>Users are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-45217 https://cve.radiocsirt.org/vuln/ghsa-h7w9-c5vx-x7j3 <p><strong>Affected:</strong> Maven: org.apache.solr:solr</p> <p>New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the &#34;trusted&#34; metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to &#34;trusted&#34; ConfigSets that may not have been created with an Authenticated request. &#34;trusted&#34; ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated &amp; Authorized.</p> <p>This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization.</p> <p>Users are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise.</p> <p><strong>Affected:</strong> Maven: org.apache.solr:solr</p> <p>New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the &#34;trusted&#34; metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to &#34;trusted&#34; ConfigSets that may not have been created with an Authenticated request. &#34;trusted&#34; ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated &amp; Authorized.</p> <p>This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization.</p> <p>Users are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise.</p> https://cve.radiocsirt.org/vuln/ghsa-h7w9-c5vx-x7j3 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-45217 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: lucene-solr, Ubuntu:Pro:16.04:LTS: lucene-solr, Ubuntu:Pro:18.04:LTS: lucene-solr, Ubuntu:20.04:LTS: lucene-solr, Ubuntu:22.04:LTS: lucene-solr, Ubuntu:24.04:LTS: lucene-solr, Ubuntu:25.10: lucene-solr, Ubuntu:26.04:LTS: lucene-solr</p> <p>Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the &#34;trusted&#34; metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to &#34;trusted&#34; ConfigSets that may not have been created with an Authenticated request. &#34;trusted&#34; ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated &amp; Authorized. This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization. Users are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: lucene-solr, Ubuntu:Pro:16.04:LTS: lucene-solr, Ubuntu:Pro:18.04:LTS: lucene-solr, Ubuntu:20.04:LTS: lucene-solr, Ubuntu:22.04:LTS: lucene-solr, Ubuntu:24.04:LTS: lucene-solr, Ubuntu:25.10: lucene-solr, Ubuntu:26.04:LTS: lucene-solr</p> <p>Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the &#34;trusted&#34; metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to &#34;trusted&#34; ConfigSets that may not have been created with an Authenticated request. &#34;trusted&#34; ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated &amp; Authorized. This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization. Users are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-45217 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3186 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Solr ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Solr ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3186