-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from missing 'trusted' flag initialization when creating ConfigSets via restore operations. The RestoreCmd class is central to backup/restore functionality, with createNewConfigSet being the logical point where ConfigSet metadata should be initialized. The JIRA ticket SOLR-17418 explicitly identifies this restoration path as the vulnerable code flow. While exact patch diffs aren't visible, the security advisory and JIRA description confirm the core issue is missing trust metadata handling during ConfigSet creation in restore operations.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.solr:solr | maven | >= 6.6.0, < 8.11.4 | 8.11.4 |
| org.apache.solr:solr | maven | >= 9.0.0, < 9.7.0 | 9.7.0 |