VDB

CVE-2019-0192

CVE-2019-0192 PUBLISHED

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.

EPSS 77.51% · 99.5th percentile

Risk Scores

EPSS Score
77.51%
99.5th percentile

Affected Products

VendorProductVersions
Ubuntu:25.10lucene-solr3.6.2+dfsg-26, 0
Ubuntu:24.04:LTSlucene-solr3.6.2+dfsg-26, 0
Ubuntu:20.04:LTSlucene-solr0, 3.6.2+dfsg-20, *
Ubuntu:Pro:18.04:LTSlucene-solr3.6.2+dfsg-18~18.04.1~esm2, 0, 3.6.2+dfsg-11
Ubuntu:22.04:LTSlucene-solr0, 3.6.2+dfsg-24
Ubuntu:Pro:14.04:LTSlucene-solr0, 3.6.2+dfsg-1, 3.6.2+dfsg-2ubuntu0.1~esm2
Ubuntu:Pro:16.04:LTSlucene-solr3.6.2+dfsg-7, 3.6.2+dfsg-8ubuntu0.1+esm1, *

Timeline

  • CVE Published
  • Mar 8, 2019 PoC Published
  • Mar 28, 2019 PoC Published
  • Mar 28, 2019 PoC Published
  • Sep 13, 2019 PoC Published
  • Jul 6, 2020 PoC Published
  • Jul 6, 2020 PoC Published
  • Sep 3, 2020 PoC Published
  • Apr 14, 2021 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Mar 7, 2023 EPSS Score
  • May 8, 2024 PoC Published

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›