Sign in
Deutsch English Español Polski
Critical

Critical severity vulnerability that affects org.apache.solr:solr-core

  • Disclosed: 14.03.2019
  • Updated: 11.10.2026 11:22

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.apache.solr:solr-core >= 5.0.0, < 7.0.0, >= 6.0.0, < 7.0.0 7.0.0

References

CVSS score 9.8/10
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-502
Platform
Java / Kotlin (Maven)
Package
org.apache.solr:solr-core
Disclosed
14.03.2019
Updated
11.10.2026 11:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-xhcq-fv7x-grr2 - CC BY 4.0

Vulnerability history: org.apache.solr:solr-core

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (31) in the archive
Total entries
31
First → latest
10.2018 06.2026
Without a fix
1
Exploited in attacks
2

Severity breakdown

  • Critical 4
  • High 16
  • Medium 10
  • Low 1

Disclosures per year

Severity:
  1. Apache Solr has hardcoded credentials in the Basic Authentication setup tool
    High · 8.1 CVE-2026-44825 >= 9.4.0, <= 9.10.1, = 10.0.0 no fix
  2. Apache Solr: Insufficient file-access checking in standalone core-creation requests
    High · 7.1 CVE-2026-22444 >= 8.6.0, < 9.10.1 9.10.1
  3. Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin
    High · 8.2 CVE-2026-22022 >= 5.3.0, < 9.10.1 9.10.1
  4. Apache Solr vulnerable to Execution with Unnecessary Privileges
    High CVE-2025-24814 < 9.8.0 9.8.0
  5. Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets
    High · 8.8 CVE-2023-50386 >= 6.0.0, < 8.11.3, >= 9.0.0, < 9.4.1 8.11.3, 9.4.1
  6. Apache Solr can leak certain passwords due to System Property redaction logic inconsistencies
    High · 7.5 CVE-2023-50291 >= 6.0.0, < 8.11.3, >= 9.0.0, < 9.3.0 8.11.3, 9.3.0
  7. Apache Solr vulnerable to XML Bomb
    High · 7.5 CVE-2019-12401 < 5.0.0 5.0.0
  8. Improper Restriction of XML External Entity Reference in Apache Solr
    High CVE-2012-6612 < 4.1.0 4.1.0
  9. Apache Solr insecure inter-node communication
    High · 7.5 CVE-2017-7660 >= 5.3.0, < 5.5.5, >= 6.0.0, < 6.6.0 5.5.5, 6.6.0
  10. Apache Solr Kerberos delegation token functionality flaws
    High · 7.5 CVE-2017-9803 >= 6.2.0, < 6.6.1 6.6.1
  11. Incorrect Authorization in Apache Solr
    Critical · 9.8 CVE-2020-13957 >= 6.6.0, < 8.6.3 8.6.3
  12. Improper permission handling in Apache Solr
    High · 7.5 CVE-2021-29262 < 8.8.2 8.8.2
  13. Improper Input Validation in Apache Solr
    High · 7.5 Exploited in attacks CVE-2019-17558 >= 5.0.0, < 8.4.0, >= 6.0.0, < 8.4.0, >= 7.0.0, < 8.4.0, >= 8.0.0, < 8.4.0 8.4.0
  14. Unrestricted upload of file with dangerous type in Apache Solr
    Critical · 9.8 CVE-2019-12409 >= 8.1.1, < 8.3.0 8.3.0
  15. XML External Entity (XXE) Injection in Apache Solr
    High · 7.2 Exploited in attacks CVE-2019-0193 < 8.2.0 8.2.0
  16. Server-Side Request Forgery (SSRF) in org.apache.solr:solr-core
    High · 7.5 CVE-2017-3164 >= 1.3.0, < 7.7.0 7.7.0
  17. Critical severity vulnerability that affects org.apache.solr:solr-core this entry
    Critical · 9.8 CVE-2019-0192 >= 5.0.0, < 7.0.0, >= 6.0.0, < 7.0.0 7.0.0
  18. Improper Limitation of a Pathname ('Path Traversal') in org.apache.solr:solr-core
    High · 7.5 CVE-2017-3163 < 5.5.4, >= 6.0.0, < 6.4.1 5.5.4, 6.4.1
  19. Remote code execution occurs in Apache Solr
    Critical · 9.8 CVE-2017-12629 >= 7.0.0, < 7.1.0, >= 6.0.0, < 6.6.2, >= 5.5.0, < 5.5.5 7.1.0, 6.6.2, 5.5.5
  20. There is a XML external entity expansion (XXE) vulnerability in Apache Solr
    High · 7.5 CVE-2018-1308 >= 1.2, < 6.6.3, >= 7.0.0, < 7.3.0 6.6.3, 7.3.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.