CVE-2015-8795: Apache Solr - Improper Neutralization of Input During Web Page Generation
Summary
CVE-2015-8795: Improper Neutralization of Input During Web Page Generation in Apache Solr. Affects org.apache.solr:solr-core versions < 5.1.0. Fixed in 5.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It provides full-text search, faceted search, and distributed search capabilities. Solr is widely used in various applications for indexing and searching large volumes of data. However, versions before 5.1 are vulnerable to multiple cross-site scripting (XSS) attacks in the Admin UI.
Vulnerability Detail
The vulnerability (CVE-2015-8795) in Apache Solr allows remote attackers to inject arbitrary web script or HTML through crafted fields. These fields are mishandled during the rendering of the Analysis and Schema-Browser pages in the Admin UI. This can lead to the execution of malicious scripts or the manipulation of the displayed content, potentially compromising the security and integrity of the application.
How To Fix
Latest published version: 10.0.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable or restrict access to the Admin UI. By limiting access to trusted users or IP addresses, the risk of exploitation can be reduced. However, this is only a temporary solution, and upgrading to the patched version is strongly advised.
Conclusion
In conclusion, the vulnerability (CVE-2015-8795) in Apache Solr exposes the application to cross-site scripting (XSS) attacks. Upgrading to the latest version of Apache Solr (5.1.0 or later) is the recommended solution. If immediate upgrade is not possible, restricting access to the Admin UI can provide temporary mitigation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.solr:solr-core →
FAQ
Apache Solr is an open-source search platform built on Apache Lucene. It provides powerful search capabilities for indexing and querying large volumes of data.
The Admin UI is a web-based interface provided by Apache Solr for managing and configuring Solr instances. It allows administrators to perform various tasks such as indexing, querying, and monitoring the Solr system.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code or the theft of sensitive information.
Exploiting this vulnerability can allow attackers to execute arbitrary scripts or manipulate the displayed content in the Admin UI of Apache Solr. This can lead to various consequences, including unauthorized access, data theft, and the compromise of the entire Solr system.
Yes, the CVSS score for this vulnerability is 6.1 (Moderate). CVSS (Common Vulnerability Scoring System) is a standardized method for assessing the severity of security vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.solr:solr-core.
