Main Vulnerability Database Vulnerabilities #VU103325

Path traversal in Apache Solr - CVE-2024-52012

Published: January 27, 2025

Vulnerability identifier: #VU103325

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-52012

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to overwrite arbitrary files on the system.

The vulnerability exists due to input validation error when handling ZIP files passed via "configset upload" API. A remote user can upload a specially crafted ZIP archive and overwrite arbitrary files on the system (a.k.a. zipslip attack).

Affected software

Apache Solr
Log Analysis
Operational Decision Manager

How to mitigate CVE-2024-52012

Install update from vendor's website.

Apache Solr - update to 9.8.0
Log Analysis - update to 1.3.8.2

External References

http://www.openwall.com/lists/oss-security/2025/01/26/2
https://lists.apache.org/thread/yp39pgbv4vf1746pf5yblz84lv30vfxd

Related Security Bulletins