CVE-2025-24814

{"id": "CVE-2025-24814", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.1}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2025-01-27T09:15:14.947", "references": [{"url": "https://lists.apache.org/thread/gl291pn8x9f9n52ys5l0pc0b6qtf0qw1", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/01/26/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20250214-0002/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-250"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Core creation allows users to replace \"trusted\" configset files with arbitrary configuration\n\nSolr instances that (1) use the \"FileSystemConfigSetService\" component (the default in \"standalone\" or \"user-managed\" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual \"trusted\" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem.\u00a0 These replacement config files are treated as \"trusted\" and can use \"<lib>\" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.\n\nThis issue affects all Apache Solr versions up through Solr 9.7.\u00a0 Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from \"FileSystemConfigSetService\").\u00a0 Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of \"<lib>\" tags by default."}, {"lang": "es", "value": "Core creation permite a los usuarios reemplazar archivos de configuraci\u00f3n \"confiables\" con instancias Solr de configuraci\u00f3n arbitraria que (1) usan el componente \"FileSystemConfigSetService\" (el valor predeterminado en modo \"aut\u00f3nomo\" o \"administrado por el usuario\") y (2) se ejecutan sin autenticaci\u00f3n ni autorizaci\u00f3n y son vulnerables a una especie de escalada de privilegios en la que los archivos de configuraci\u00f3n \"confiables\" individuales pueden ignorarse a favor de reemplazos potencialmente no confiables disponibles en otras partes del sistema de archivos. Estos archivos de configuraci\u00f3n de reemplazo se tratan como \"confiables\" y pueden usar etiquetas \"\" para agregarlos a la ruta de clase de Solr, que un atacante podr\u00eda usar para cargar c\u00f3digo malicioso como un searchComponent u otro complemento. Este problema afecta a todas las versiones de Apache Solr hasta Solr 9.7. Los usuarios pueden protegerse contra la vulnerabilidad habilitando la autenticaci\u00f3n y la autorizaci\u00f3n en sus cl\u00fasteres Solr o cambiando a SolrCloud (y dejando de lado \"FileSystemConfigSetService\"). Tambi\u00e9n se recomienda a los usuarios actualizar a Solr 9.8.0, que mitiga este problema al deshabilitar el uso de etiquetas \"\" de forma predeterminada."}], "lastModified": "2025-06-25T16:41:43.923", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D59403D1-1B17-4DF8-9100-F3A87BCA78B1", "versionEndExcluding": "9.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}