Homepage

Unrestricted Upload of File with Dangerous Type The advisory has been revoked - it doesn't affect any version of package lucene-solr  (opens in a new tab)

Threat Intelligence

Exploit Maturity
Proof of Concept
EPSS
21.61% (98th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN9-LUCENESOLR-603807
  • published19 Aug 2020
  • disclosed18 Nov 2019
Report a new vulnerability Found a mistake?

Introduced: 18 Nov 2019

CVE-2019-12409  (opens in a new tab)
CWE-434  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream lucene-solr package and not the lucene-solr package as distributed by Debian.

The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication. If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn allow them to upload malicious code for execution on the Solr server.

References