-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.solr:solr-core | maven | < 9.8.0 | 9.8.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from Solr's handling of <lib> tags in configurations. The initLibs method in SolrConfig.java was responsible for loading libraries specified in configsets. In vulnerable versions, this function would process these directives even when running in insecure 'standalone' mode without authentication, letting attackers replace trusted configset files with malicious ones containing <lib> tags. The GitHub commit shows this method was modified to add a system property check (solr.config.lib.enabled) to disable the feature by default, confirming it as the attack vector. The CWE-250 mapping and advisory descriptions directly implicate privilege escalation via classpath manipulation through this function.