5.4

CVE-2024-52012: apache software foundation apache solr Relative Path Traversal

CVSS: 5.4v3.1MediumAnalyzed
AliasesCGA-cjmx-6vpc-wx86CGA-hw9m-r4h8-5w9pCGA-jr2v-92q3-gwj5
Published 27-01-2025Last modified 06-02-2025
Open JSON

Vulnerability summary

CVE-2024-52012 is a medium (CVSS 5.4) Relative Path Traversal vulnerability in apache software foundation apache solr. EPSS estimates a 44.99% chance of exploitation in the next 30 days, higher than 98.7% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.4/10
010
Medium · v3.1 (CVE.org)
EPSS score
44.99%
0%100%
High · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-M5X2-C7H8-P8H2

Timeline

  1. 27-01-2025
    PublishedVulnerability first disclosed.
  2. 06-02-2025
    Last modifiedVulnerability information updated.

Description

Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API.  Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem. This issue affects Apache Solr: from 6.6 through 9.7.0. Users are recommended to upgrade to version 9.8.0, which fixes the issue.  Users unable to upgrade may also safely prevent the issue by using Solr's "Rule-Based Authentication Plugin" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users.

CVSS metrics

5 scores · 5 sources · 2 versions

EPSS trend

Probability

44.99%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 44.99% on 18-09-2026

18-09-202618-10-2026
EPSS score
44.99%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard5 products
  • hadoop-fips-3.3.6All versions (No fix recorded)
  • hadoop-fips-3.4.2All versions (No fix recorded)
  • hadoop-fips-3.5All versions (No fix recorded)
  • solrAll versions (No fix recorded)
  • solr-oci-compatAll versions (No fix recorded)
Wolfi2 products
  • solrAll versions (No fix recorded)
  • solr-oci-compatAll versions (No fix recorded)
Apache1 product
  • solr≥ 6.6.0, < 9.8.0
Apache software foundation1 product
Org.apache.solr1 product
  • solr-core≥ 6.6, < 9.8.0

5 vendors · 10 products

References

7 links