Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to "trusted" ConfigSets that may not have been created with an Authenticated request. "trusted" ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated & Authorized. This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization. Users are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created     via a Restore command, which copy a configSet from the backup and give it a new name, are created without     setting the trusted metadata. ConfigSets that do not contain the flag are trusted implicitly if the     metadata is missing, therefore this leads to trusted ConfigSets that may not have been created with an     Authenticated request. trusted ConfigSets are able to load custom code into classloaders, therefore the     flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated & Authorized.
    This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not     affect Solr instances that are secured via Authentication/Authorization. Users are primarily recommended     to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4     will mitigate this issue otherwise. (CVE-2024-45217)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created
    via a Restore command, which copy a configSet from the backup and give it a new name, are created without
    setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted implicitly if the
    metadata is missing, therefore this leads to "trusted" ConfigSets that may not have been created with an
    Authenticated request. "trusted" ConfigSets are able to load custom code into classloaders, therefore the
    flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated & Authorized.
    This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not
    affect Solr instances that are secured via Authentication/Authorization. Users are primarily recommended
    to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4
    will mitigate this issue otherwise. (CVE-2024-45217)

ID	Name	Product	Family	Type	Severity
258398	Linux Distros Unpatched Vulnerability : CVE-2024-45217	Nessus	Misc.	Local	high
415579	SCA: security update for org.apache.solr:solr (GHSA-h7w9-c5vx-x7j3)	Tenable Cloud Security	SCA Checks	Local	high
415579	SCA: security update for org.apache.solr:solr (GHSA-h7w9-c5vx-x7j3)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2024-45217

high

Tenable Plugins

high

high

high