{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-02-15T00:10:36.558Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/01/26/1"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20250214-0002/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-24814",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-27T14:10:58.492586Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-06T16:02:37.895Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Solr",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "9.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "pwn null"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCore creation allows users to replace \"trusted\" configset files with arbitrary configuration\u003c/p\u003eSolr instances that (1) use the \"FileSystemConfigSetService\" component (the default in \"standalone\" or \"user-managed\" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual \"trusted\" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem.\u0026nbsp; These replacement config files are treated as \"trusted\" and can use \"\u0026lt;lib\u0026gt;\" tags to add to Solr\u0027s classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.\u003cbr\u003e\u003cbr\u003eThis issue affects all Apache Solr versions up through Solr 9.7.\u0026nbsp; Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from \"FileSystemConfigSetService\").\u0026nbsp; Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of \"\u0026lt;lib\u0026gt;\" tags by default.\u003cbr\u003e"
            }
          ],
          "value": "Core creation allows users to replace \"trusted\" configset files with arbitrary configuration\n\nSolr instances that (1) use the \"FileSystemConfigSetService\" component (the default in \"standalone\" or \"user-managed\" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual \"trusted\" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem.\u00a0 These replacement config files are treated as \"trusted\" and can use \"\u003clib\u003e\" tags to add to Solr\u0027s classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.\n\nThis issue affects all Apache Solr versions up through Solr 9.7.\u00a0 Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from \"FileSystemConfigSetService\").\u00a0 Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of \"\u003clib\u003e\" tags by default."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250 Execution with Unnecessary Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-27T08:58:08.768Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/gl291pn8x9f9n52ys5l0pc0b6qtf0qw1"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Solr: Core-creation with \"trusted\" configset can use arbitrary untrusted files",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-24814",
    "datePublished": "2025-01-27T08:58:08.768Z",
    "dateReserved": "2025-01-24T12:48:40.114Z",
    "dateUpdated": "2025-02-15T00:10:36.558Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-24814\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2025-01-27T09:15:14.947\",\"lastModified\":\"2025-02-15T01:15:11.157\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Core creation allows users to replace \\\"trusted\\\" configset files with arbitrary configuration\\n\\nSolr instances that (1) use the \\\"FileSystemConfigSetService\\\" component (the default in \\\"standalone\\\" or \\\"user-managed\\\" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual \\\"trusted\\\" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem.\u00a0 These replacement config files are treated as \\\"trusted\\\" and can use \\\"\u003clib\u003e\\\" tags to add to Solr\u0027s classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.\\n\\nThis issue affects all Apache Solr versions up through Solr 9.7.\u00a0 Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from \\\"FileSystemConfigSetService\\\").\u00a0 Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of \\\"\u003clib\u003e\\\" tags by default.\"},{\"lang\":\"es\",\"value\":\"Core creation permite a los usuarios reemplazar archivos de configuraci\u00f3n \\\"confiables\\\" con instancias Solr de configuraci\u00f3n arbitraria que (1) usan el componente \\\"FileSystemConfigSetService\\\" (el valor predeterminado en modo \\\"aut\u00f3nomo\\\" o \\\"administrado por el usuario\\\") y (2) se ejecutan sin autenticaci\u00f3n ni autorizaci\u00f3n y son vulnerables a una especie de escalada de privilegios en la que los archivos de configuraci\u00f3n \\\"confiables\\\" individuales pueden ignorarse a favor de reemplazos potencialmente no confiables disponibles en otras partes del sistema de archivos. Estos archivos de configuraci\u00f3n de reemplazo se tratan como \\\"confiables\\\" y pueden usar etiquetas \\\"\\\" para agregarlos a la ruta de clase de Solr, que un atacante podr\u00eda usar para cargar c\u00f3digo malicioso como un searchComponent u otro complemento. Este problema afecta a todas las versiones de Apache Solr hasta Solr 9.7. Los usuarios pueden protegerse contra la vulnerabilidad habilitando la autenticaci\u00f3n y la autorizaci\u00f3n en sus cl\u00fasteres Solr o cambiando a SolrCloud (y dejando de lado \\\"FileSystemConfigSetService\\\"). Tambi\u00e9n se recomienda a los usuarios actualizar a Solr 9.8.0, que mitiga este problema al deshabilitar el uso de etiquetas \\\"\\\" de forma predeterminada.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-250\"}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/gl291pn8x9f9n52ys5l0pc0b6qtf0qw1\",\"source\":\"security@apache.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2025/01/26/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20250214-0002/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}