Not rated
CVE-2019-12409 The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration…
Description
The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication. If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn allow them to upload malicious code for execution on the Solr server.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Solr | Versions not published |
References
- [lucene-solr-user] 20191118 CVE-2019-12409: Apache Solr RCE vulnerability due to bad config default lists.apache.org
- [lucene-issues] 20191118 [jira] [Commented] (SOLR-13647) CVE-2019-12409: Apache Solr RCE vulnerability due to bad config default lists.apache.org
- [lucene-issues] 20191118 [jira] [Updated] (SOLR-13647) CVE-2019-12409: Apache Solr RCE vulnerability due to bad config default lists.apache.org
- [lucene-general] 20191118 CVE-2019-12409: Apache Solr RCE vulnerability due to bad config default lists.apache.org
- [announce] 20191118 [CVE-2019-12409] Apache Solr RCE vulnerability due to bad config default lists.apache.org
- support.f5.com support.f5.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Solr
The 5 CVEs of Solr →
CVE-2024-45216
Improper Authentication vulnerability in Apache Solr
Not rated
CVE-2023-50298
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache…
Not rated
CVE-2023-50386
Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of…
Not rated
CVE-2019-12401
Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack…
Not rated