cve.bz

CVE-2019-12409

9.8 criticalEPSS 22%

Critical (9.8) in apache solr. EPSS 22% chance of exploitation in the next 30 days. Fixed in org.apache.solr:solr-core 8.3.0.

The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication. If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn allow them to upload malicious code for execution on the Solr server.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
22% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE
CWE-434
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-2289-pqfq-6wx7Mavenorg.apache.solr:solr-core>=8.1.1 <8.3.08.3.0

References

Check your stackJSON