Critical severity vulnerability that affects org.apache.solr:solr-core
Critical severity
GitHub Reviewed
Published
Mar 14, 2019
to the GitHub Advisory Database
•
Updated Jan 9, 2023
Package
Affected versions
>= 5.0.0, <= 5.5.5
>= 6.0.0, <= 6.6.5
Patched versions
7.0.0
7.0.0
Description
Published to the GitHub Advisory Database
Mar 14, 2019
Reviewed
Jun 16, 2020
Last updated
Jan 9, 2023
In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.
References