CVE-2019-12409

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 21.45%
EPSS Percentile: 97.59%
CISA KEV: Not listed

Description

The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication. If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn allow them to upload malicious code for execution on the Solr server.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: security@apache.org
Published: 19-Nov-2019 04:15
Last Modified: 17-Jun-2026 09:14
EPSS Date: 2026-10-18
CWE: CWE-434

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

apache / solr
Version / affected range: 8.1.1
cpe:2.3:a:apache:solr:8.1.1:*:*:*:*:*:*:*
apache / solr
Version / affected range: 8.2.0
cpe:2.3:a:apache:solr:8.2.0:*:*:*:*:*:*:*

References

Last enrichment sync: 19-Oct-2026 09:01
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

8.1.1 is known to have multiple Remote Code Execution (RCE) vulnerabilities, including CVE-2019-0193, CVE-2019-12409, CVE-2019-17558, and CVE-2021-44228, making it a prime target for exploitation. Wiz Details Seven Summer 2023 Cryptomining Incidents Targeting Cloud Workloads

CVE (2)

Malware (7)

MITRE ATT&CK (14)

Vendors (1)

Products (3)

Tools (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.