CVE-2019-0192: apache software foundation apache solr Deserialization of Untrusted Data
Vulnerability summary
CVE-2019-0192 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in apache software foundation apache solr. EPSS estimates a 78.23% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities.
Timeline
- 07-03-2019PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
78.23%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
+0.72 pp
From 77.51% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache1 product
- solr≥ 5.0.0, ≤ 5.5.5 | ≥ 6.0.0, ≤ 6.6.5
Apache software foundation1 product
- apache solrApache Solr 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5
Netapp1 product
Org.apache.solr1 product
- solr-core≥ 5.0.0, < 7.0.0 | ≥ 6.0.0, < 7.0.0
Ubuntu1 product
- lucene-solrAll versions (No fix recorded)
5 vendors · 5 products
References
27 links- mail-archives.us.apache.org/mod_mbox/…Mailing ListX Refsource MLISTMitigationVendor AdvisoryREPORTWEB
