[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2024-45216":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":20,"cwes":21,"cpes":24,"technologies":105,"references":107,"score":113,"epss_score":114,"epss_percentile":115,"is_kev":116,"cisa_kev_date_added":117,"cisa_kev_due_date":117,"cisa_ssvc":118,"attack_mappings":128,"exploits":135},23811,"CVE-2024-45216","EUVD-2024-3084","Improper Authentication vulnerability in Apache Solr\n\nSolr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.\n\n\nThis issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.\n\nUsers are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.","2024-10-16T09:30:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":17,"userInteraction":18,"attackComplexity":19,"availabilityImpact":17,"privilegesRequired":18,"confidentialityImpact":17},"UNCHANGED","3.1",9.8,"NETWORK","CRITICAL","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","HIGH","NONE","LOW",true,[22,23],"CWE-863","CWE-287",[25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104],"cpe:2.3:a:apache:solr:6.0.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.5.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.8.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:9.0.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.3.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:5.5.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:7.7.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:6.1.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:9.5.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.6.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.1.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:6.6.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:7.3.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:6.3.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:6.5.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:9.2.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:6.4.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:5.3.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:9.2.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.8.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:5.5.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:9.6.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:6.2.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.11.3:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:6.4.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:7.7.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.6.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:9.3.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:5.5.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.2.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:6.0.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.5.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:9.1.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.11.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:7.7.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:9.6.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:7.0.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.6.3:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.10.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.6.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:5.5.3:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:5.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.4.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:7.1.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:5.3.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.5.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.1.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:7.7.3:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.11.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.1.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:5.4.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:5.4.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:6.4.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.11.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:9.1.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:6.2.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:5.5.5:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:7.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:7.5.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.10.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:6.5.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:8.4.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:9.4.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:5.5.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:apache:solr:6.6.3:*:*:*:*:*:*:*",[106],"Apache Solr",[108,109,110,111,112],"https:\u002F\u002Fsolr.apache.org\u002Fsecurity.html#cve-2024-45216-apache-solr-authentication-bypass-possible-using-a-fake-url-path-ending","http:\u002F\u002Fwww.openwall.com\u002Flists\u002Foss-security\u002F2024\u002F10\u002F15\u002F8","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-45216","https:\u002F\u002Fissues.apache.org\u002Fjira\u002Fbrowse\u002FSOLR-17417","http:\u002F\u002Fsvn.apache.org\u002Fviewvc\u002Flucene\u002Fdev\u002Fbranches\u002Fbranch_4x\u002Fsolr\u002Fwebapp",0.89,0.92747,0.99827,false,null,{"timestamp":119,"automatable":120,"tech_impact":121,"exploitation":122,"cisa_decision":123,"cisa_remediation_timeline":127},"2024-10-16T17:02:39.052989Z","yes","total","none",{"vector":124,"decision":125,"priority":126},"CISAv1\u002FE:N\u002FA:Y\u002FT:T\u002FM:H\u002F2026-10-25T19:37:33.888280\u002F","attend","medium","3D",[129],{"name":130,"source":131,"tactics":132,"technique_id":134},"Exploit Public-Facing Application","attack_vector",[133],"initial-access","T1190",[136],{"link":137},"https:\u002F\u002Fgithub.com\u002Fprojectdiscovery\u002Fnuclei-templates\u002Fblob\u002Fmain\u002Fhttp\u002Fcves\u002F2024\u002FCVE-2024-45216.yaml"]