Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing. This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0. Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin,     which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A     fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while     maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API     path, however it is stripped off internally after authentication but before API routing. This issue     affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0. Users are recommended to upgrade     to version 9.7.0, or 8.11.4, which fix the issue. (CVE-2024-45216)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin,
    which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A
    fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while
    maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API
    path, however it is stripped off internally after authentication but before API routing. This issue
    affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0. Users are recommended to upgrade
    to version 9.7.0, or 8.11.4, which fix the issue. (CVE-2024-45216)

Apache Solr versions 5.3.0 prior to 8.11.4 or 9.x prior to 9.7.0 using the PKIAuthenticationPlugin, which is activated by default when Solr authentication is used, enables an attacker to bypass authentication via a specially forged request.

ID	Name	Product	Family	Severity
258162	Linux Distros Unpatched Vulnerability : CVE-2024-45216	Nessus	Misc.	critical
417015	SCA: security update for org.apache.solr:solr (GHSA-mjvf-4h88-6xm3)	Tenable Cloud Security	SCA Checks	critical
417015	SCA: security update for org.apache.solr:solr (GHSA-mjvf-4h88-6xm3)	Tenable Self-Hosted Container Security	SCA Checks	critical
114496	Apache Solr 5.3.0 < 8.11.4 / 9.x < 9.7.0 Authentication Bypass	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2024-45216

critical

Tenable Plugins

critical

critical

critical

critical