CVE-2019-0192 Public exploit EPSS 78.2%

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an…

Apache Software Foundation · Apache Solr

Summary

The flaw is in Apache Solr's Config API, which lets the JMX server be configured through an HTTP POST request, and it affects the 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5 release ranges. An attacker who can send such a request can point the JMX configuration at a malicious RMI server, and Solr's unsafe deserialization then lets that attacker execute code on the Solr host, though the exact network, authentication, or configuration conditions required are not specified.

Official description · CVE.org

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.

Breakdown

59.9 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 0
Tactics: 0/15

First seen exploited 2 years after disclosure. Public exploit code (PoC-in-GitHub) appeared 3 days after disclosure.

Disclosed7 Mar 2019day 0
Public exploit codePoC-in-GitHub10 Mar 2019+3 days
First seen exploitedVulnCheck KEV evidence12 Apr 2021+2 yrs

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.solr:solr-core.

Mavenorg.apache.solr:solr-coreGHSA-xhcq-fv7x-grr2

Upgrade to 7.1.0

Fixes this CVE and 1 other known vulnerability in this package (CVE-2017-12629).

Still affected on this line by CVE-2019-0193 (fixed in 8.2.0, a newer line); CVE-2019-17558 (fixed in 8.4.0, a newer line); CVE-2020-13957 (fixed in 8.6.3, a newer line); CVE-2023-50386 (fixed in 8.11.3, a newer line).

Set the version to 7.1.0 or later in your pom.xml or build.gradle.

First fixed in 7.0.0 for CVE-2019-0192.

Affected versions, by release line

If you run	Upgrade to
6.0.0 up to 7.0.0	7.1.0first fix for this CVE: 7.0.0
5.0.0 up to 7.0.0 Still affected on this line by CVE-2017-12629 (fixed in 7.1.0, a newer line); CVE-2019-0193 (fixed in 8.2.0, a newer line); CVE-2019-17558 (fixed in 8.4.0, a newer line); CVE-2020-13957 (fixed in 8.6.3, a newer line); CVE-2023-50386 (fixed in 8.11.3, a newer line).	7.0.0

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

14 links, grouped by NVD tag

vdb-entry 1

securityfocus.com/bid/107318

mailing-list 9

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2019-0397

Public exploitAdvisories link exploit code.

, 30 Oct 2026

78.2%Top 0.42%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.58%).

No CVSS score published.

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 2028 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9958 19.9/20

Threat reports0 reports 0.0/10

Public exploit code2 PoC-in-GitHub repos; 1 nuclei template 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total59.9

Record

Published: 7 Mar 2019
Modified: 16 Sep 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques