CVE detail

CVE-2019-12409 — CVE-2019-12409

Published 2019-11-18 · Modified 2026-06-17 · Vendor apache · Product solr · Source nvd

CRITICAL

severity

CVSS-derived band

9.8

CVSS v3

0–10 scale

0.2226

EPSS probability

exploitation probability, 30d

97.0%

EPSS percentile

percentile vs all CVEs

NOT LISTED

CISA KEV

known exploited catalog

Description

The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication. If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn allow them to upload malicious code for execution on the Solr server.

Remediation

No vendor-published fix data in our corpus for this CVE. Check the references below or the vendor's PSIRT / security advisories page.

References

cvedb.io · NVD · CISA KEV · FIRST EPSS · vendor advisories (CVE Program List v5). Informational only, no warranty — verify every remediation against the vendor advisory before acting on it. This product uses data from the NVD API but is not endorsed or certified by the NVD, CISA, FIRST.org or any vendor named. CVE® is a registered trademark of The MITRE Corporation.