CVE-2019-17558: Improper Input Validation in Apache Solr

CVE-2019-17558 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2020-02-12

Apache Solr is vulnerable to Remote Code Execution via the VelocityResponseWriter plug-in. An attacker can trigger execution by providing malicious Velocity templates through a configset directory or by enabling the 'params.resource.loader.enabled' setting via the Configuration API.

Technologies: Apache Solr, org.apache.solr:solr-core (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2019-17558 exploited in the wild?
Yes. CVE-2019-17558 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.
How severe is CVE-2019-17558?
Critical severity, with a CVSS score of 3.1, published 12 February 2020.
Which products and versions are affected?
org.apache.solr:solr-core (Maven) ECOSYSTEM:introduced=5.0.0,fixed=8.4.0.
Is there a fix for CVE-2019-17558?
Yes. org.apache.solr:solr-core (Maven): upgrade to 8.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-17558 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2019-17558?
Check whether you run Apache Solr or org.apache.solr:solr-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.solr:solr-core (Maven): upgrade to 8.4.0 or later
    # set org.apache.solr:solr-core to 8.4.0 in your pom.xml or build.gradle

Affected products

  • Apache Solr 5.0.0 to 8.3.1

Identifiers

  • CVE-2019-17558
  • GHSA-ww97-9w65-2crx

Timeline

  • 2021-11-03: disclosed
  • exploited: Reported exploited in the wild.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.