Skip to content
Fencer Vulns
critical 9.8

CVE-2019-12409 in the critical feed json

Unrestricted upload of file with dangerous type in Apache Solr

published 2019-11-18 6 y ago modified 2026-06-17 4 mo ago also GHSA-2289-pqfq-6wx7 , EUVD-2020-0244

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
21.6%
EPSS 21.6% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication. If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn allow them to upload malicious code for execution on the Solr server.

Patch / fix

  • maven org.apache.solr:solr-core 8.3.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-12409 updated cvss 9.1

solr: JMX monitoring service exposed without authentication in default configuration

  • Red Hat JBoss Enterprise Application Platform 6 solr-core Red Hat JBoss Fuse Service Works 6 solr-core
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat JBoss Data Virtualization 6 solr-core Red Hat JBoss Fuse 6 solr-core
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

21.61% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-12409-RCE%20Vulnerability%20Due%20to%20Bad%20Defalut%20Config-Apache%20Solr referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.solr:solr-core
>=8.1.1, <8.3.0
8.3.0

Affected products

  • Apache Solr

Classification

Weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.