{
  "cveId": "CVE-2025-24814",
  "url": "https://patchblox.com/security/cve/CVE-2025-24814",
  "summary": "CVE-2025-24814 is fixed in lucene-solr on 1 platform, first by DEBIAN-CVE-2025-24814, released January 27, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "lucene-solr: Core creation allows users to replace \u0022trusted\u0022 configset files with arbitrary configuration  Solr instances that (1)...",
  "description": "Core creation allows users to replace \u0022trusted\u0022 configset files with arbitrary configuration  Solr instances that (1) use the \u0022FileSystemConfigSetService\u0022 component (the default in \u0022standalone\u0022 or \u0022user-managed\u0022 mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual \u0022trusted\u0022 configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem.\u00A0 These replacement config files are treated as \u0022trusted\u0022 and can use \u0022\u003Clib\u003E\u0022 tags to add to Solr\u0027s classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.  This issue affects all Apache Solr versions up through Solr 9.7.\u00A0 Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from \u0022FileSystemConfigSetService\u0022).\u00A0 Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of \u0022\u003Clib\u003E\u0022 tags by default.",
  "published": "2025-01-27T09:15:14Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
  "epss": 0.01221,
  "epssPercentile": 0.68891,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "lucene-solr",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3.6.2\u002Bdfsg-23",
      "fix": "DEBIAN-CVE-2025-24814",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-24814",
      "released": "2025-01-27T09:15:14Z"
    },
    {
      "platform": "linux",
      "product": "lucene-solr",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.6.2\u002Bdfsg-23",
      "fix": "DEBIAN-CVE-2025-24814",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-24814",
      "released": "2025-01-27T09:15:14Z"
    },
    {
      "platform": "linux",
      "product": "lucene-solr",
      "release": "Debian 14",
      "fixedVersion": "3.6.2\u002Bdfsg-23",
      "fix": "DEBIAN-CVE-2025-24814",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-24814",
      "released": "2025-01-27T09:15:14Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}