Unrestricted file upload in Apache Solr
Priority MEDIUM 62CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-434.
Summary
The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication. If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn allow them to upload malicious code for execution on the Solr server.
Why it matters now
EPSS 0.21614 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.apache.solr:solr-core (Maven): 8.3.0Red Hat: 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Solr | 8.1.1 and 8.2.0 for Linux | — | No fix listed | CNA |
| — | org.apache.solr:solr-core (Maven) | 8.1.1 to before 8.3.0 | 8.3.0 | Patch available | GHSA-2289-pqfq-6wx7 |
- Solr VendorApache Affected 8.1.1 and 8.2.0 for Linux Fixed in — No fix listed CNA
- org.apache.solr:solr-core (Maven) Vendor— Affected 8.1.1 to before 8.3.0 Fixed in 8.3.0 Patch available GHSA-2289-pqfq-6wx7
Remediation
- Fix · GHSA-2289-pqfq-6wx7 org.apache.solr:solr-core (Maven) Fixed in 8.3.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
Not affected: 2 products
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Fuse 6
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12409
- 2026-10-03 Alias added: GHSA-2289-pqfq-6wx7
References
Other 14
- [lucene-solr-user] 20191118 CVE-2019-12409: Apache Solr RCE vulnerability due to bad config default
- [lucene-issues] 20191118 [jira] [Commented] (SOLR-13647) CVE-2019-12409: Apache Solr RCE vulnerability due to bad config default
- [lucene-issues] 20191118 [jira] [Updated] (SOLR-13647) CVE-2019-12409: Apache Solr RCE vulnerability due to bad config default
- [lucene-general] 20191118 CVE-2019-12409: Apache Solr RCE vulnerability due to bad config default
- [announce] 20191118 [CVE-2019-12409] Apache Solr RCE vulnerability due to bad config default
- https://support.f5.com/csp/article/K23720587?utm_source=f5support&%3Butm_medium=RSS
- https://github.com/github/advisory-review/pull/12462
- https://issues.apache.org/jira/browse/SOLR-13647
- https://lists.apache.org/thread.html/47e112035b4aa67ece3b75dbcd1b9c9212895b9dfe2a71f6f7c174e2@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/6640c7e370fce2b74e466a605a46244ccc40666ad9e3064a4e04a85d@%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/925cdb49ceae78baddb45da7beb9b4d2b1ddc4a8e318c65e91fb4e87@%3Cissues.lucene.apache.org%3E
- https://lists.apache.org/thread.html/a044eae4f6f5b0160ece5bf9cc4c0dad90ce7dd9bb210a9dc50b54be@%3Cgeneral.lucene.apache.org%3E
- https://lists.apache.org/thread.html/ce7c0b456b15f6c7518adefa54ec948fed6de8e951a2584500c1e541@%3Cissues.lucene.apache.org%3E
- https://support.f5.com/csp/article/K23720587?utm_source=f5support&utm_medium=RSS
More Apache Solr vulnerabilities
- TI-2024-30303 Apache Solr: Authentication bypass possible using a fake URL Path ending CVSS 3.1CRITICAL 9.8
- TI-2019-13101 Injection in Apache Solr KEVCVSS 3.1HIGH 7.5
- TI-2019-00170 Code injection in Apache Solr KEVCVSS 3.1HIGH 7.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2021-09240 SSRF vulnerability with the Replication handler CVSS 3.1CRITICAL 9.8
- TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-12409 · CVE Program
- CVE-2019-12409 · NVD
- FIRST EPSS
- GHSA-2289-pqfq-6wx7 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-12409 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences