https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 15:38:27 +0000 https://vulnerability.circl.lu/vuln/cve-2023-50292 <p><strong>Affected:</strong> Apache Software Foundation Apache Solr</p> <p>Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr.</p> <p>This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0.</p> <p>The Schema Designer was introduced to allow users to more easily configure and test new Schemas and configSets. However, when the feature was created, the &#34;trust&#34; (authentication) of these configSets was not considered. External library loading is only available to configSets that are &#34;trusted&#34; (created by authenticated users), thus non-authenticated users are unable to perform Remote Code Execution. Since the Schema Designer loaded configSets without taking their &#34;trust&#34; into account, configSets that were created by unauthenticated users were allowed to load external libraries when used in the Schema Designer.</p> <p>Users are recommended to upgrade to version 9.3.0, which fixes the issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Solr</p> <p>Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr.</p> <p>This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0.</p> <p>The Schema Designer was introduced to allow users to more easily configure and test new Schemas and configSets. However, when the feature was created, the &#34;trust&#34; (authentication) of these configSets was not considered. External library loading is only available to configSets that are &#34;trusted&#34; (created by authenticated users), thus non-authenticated users are unable to perform Remote Code Execution. Since the Schema Designer loaded configSets without taking their &#34;trust&#34; into account, configSets that were created by unauthenticated users were allowed to load external libraries when used in the Schema Designer.</p> <p>Users are recommended to upgrade to version 9.3.0, which fixes the issue.</p> https://vulnerability.circl.lu/vuln/cve-2023-50292