{"id":9691,"date":"2019-12-03T01:16:58","date_gmt":"2019-12-03T01:16:58","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=9691"},"modified":"2026-04-17T18:07:51","modified_gmt":"2026-04-17T18:07:51","slug":"apache-solr-remote-code-execution-vulnerability-cve-2019-12409-threat-alert","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/apache-solr-remote-code-execution-vulnerability-cve-2019-12409-threat-alert\/","title":{"rendered":"Apache Solr Remote Code Execution Vulnerability (CVE-2019-12409) Threat Alert"},"content":{"rendered":"


\n<\/p>\n

Vulnerability Description<\/strong><\/h2>\n

On November 18, local time, Apache Software Foundation (ASF) released an official security bulletin to reveal a remote code execution vulnerability (CVE-2019-12409) in Apache Solr. This vulnerability exists and can bring security risks because the configuration item ENABLE_REMOTE_JMX_OPTS in the configuration file solr.in.sh<\/strong> is enabled by default.<\/p>\n

If you use the default configuration file solr.in.sh<\/strong> from the affected Solr release, JMX monitoring will be enabled and exposed on the RMI port (default is 18983), without any authentication. If this port is opened for inbound traffic in your firewall, anyone with access to your Solr nodes will be able to access JMX and can upload malicious code to execute on the Solr server. Please check and fix the vulnerability.<\/p>\n

References:<\/p>\n

https:\/\/lucene.apache.org\/solr\/news.html<\/p>\n

https:\/\/issues.apache.org\/jira\/browse\/SOLR-13647<\/p>\n

Scope of Impact<\/strong><\/h2>\n

Affected Versions<\/strong><\/p>\n

Apache Solr 8.1.1<\/p>\n

Apache Solr 8.2.0<\/p>\n

Note: Only Solr on Linux systems is vulnerable, but not affected on Windows systems.<\/p>\n

Vulnerability Detection<\/strong><\/h2>\n

Manual Detection<\/strong><\/h3>\n

On the dashboard of the Solr background, you can view the current Solr version information. If the Solr version is vulnerable, there may be security risks.<\/p>\n

\"Red<\/a><\/p>\n

If the configuration item ENABLE_REMOTE_JMX_OPTS in solr.in.sh<\/strong> is true<\/strong>, Solr may be vulnerable.<\/p>\n

\"Red<\/a><\/p>\n

Vulnerability Protection<\/strong><\/h2>\n

At present, ASF has not released a new version to fix the vulnerability. Affected users are advised to visit the following website to obtain the latest updates immediately after they are available:<\/p>\n

https:\/\/lucene.apache.org\/solr\/<\/p>\n

Temporary Mitigation Measures<\/strong><\/h3>\n

ASF officially provides the following mitigation measures:<\/p>\n