VDB

CVE-2019-0192

CVE-2019-0192 PUBLISHED KEV CVSS 9.800000190734863 CRITICAL

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.

EPSS 77.51% · 99.5th percentile

Risk Scores

CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
77.51%
99.5th percentile

Affected Products

VendorProductVersions
Ubuntu:25.10lucene-solr3.6.2+dfsg-26, 0
Ubuntu:24.04:LTSlucene-solr3.6.2+dfsg-26, 0
Ubuntu:20.04:LTSlucene-solr0, 3.6.2+dfsg-20, *
Ubuntu:Pro:18.04:LTSlucene-solr3.6.2+dfsg-18~18.04.1~esm2, 0, 3.6.2+dfsg-11
Ubuntu:22.04:LTSlucene-solr0, 3.6.2+dfsg-24
Ubuntu:Pro:14.04:LTSlucene-solr0, 3.6.2+dfsg-1, 3.6.2+dfsg-2ubuntu0.1~esm2
Ubuntu:Pro:16.04:LTSlucene-solr3.6.2+dfsg-7, 3.6.2+dfsg-8ubuntu0.1+esm1, *

Timeline

  • CVE Published
  • Mar 8, 2019 PoC Published
  • Mar 10, 2019 VulnCheck XDB Entry
  • Mar 28, 2019 PoC Published
  • Mar 28, 2019 PoC Published
  • Sep 13, 2019 PoC Published
  • Nov 1, 2019 VulnCheck XDB Entry
  • Jul 6, 2020 PoC Published
  • Jul 6, 2020 PoC Published
  • Sep 3, 2020 PoC Published
  • Apr 12, 2021 VulnCheck KEV Exploitation
  • Apr 14, 2021 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›