CVE-2019-12409: Unrestricted upload of file with dangerous type in Apache Solr
Summary
CVE-2019-12409: Unrestricted upload of file with dangerous type in Apache Solr. Affects org.apache.solr:solr-core versions >= 8.1.1, < 8.3.0. Fixed in 8.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It provides full-text search, faceted search, and indexing capabilities. Solr is widely used in various applications for efficient and scalable search functionality. However, versions 8.1.1 and 8.2.0 of Apache Solr contain a vulnerability that allows for the unrestricted upload of files with dangerous types.
Vulnerability Detail
The vulnerability arises from an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file. By default, JMX monitoring is enabled and exposed on the RMI_PORT (default=18983) without any authentication. If this port is open for inbound traffic, anyone with network access to the Solr nodes can access JMX, potentially allowing them to upload and execute malicious code on the Solr server. This vulnerability has a CVSS score of 9.8 (Critical).
How To Fix
Latest published version: 10.0.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.3.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable JMX monitoring or restrict access to the RMI_PORT. This can be achieved by modifying the solr.in.sh configuration file to set ENABLE_REMOTE_JMX_OPTS=false or by configuring firewall rules to block inbound traffic to the RMI_PORT.
Conclusion
The vulnerability in Apache Solr versions 8.1.1 and 8.2.0 allows for the unrestricted upload of files with dangerous types, potentially leading to the execution of malicious code. It is crucial to upgrade to Apache Solr version 8.3.0 or later to mitigate this vulnerability. If immediate upgrading is not possible, consider implementing the provided workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.solr:solr-core →
FAQ
Apache Solr is an open-source search platform built on Apache Lucene. It provides full-text search, faceted search, and indexing capabilities.
Versions 8.1.1 and 8.2.0 of Apache Solr are affected by this vulnerability.
This vulnerability allows for the unrestricted upload of files with dangerous types, potentially enabling the execution of malicious code on the Solr server.
To fix this vulnerability, it is recommended to upgrade to Apache Solr version 8.3.0 or later. This version includes a fix for the insecure setting and ensures that JMX monitoring requires authentication.
Yes, a temporary workaround is to disable JMX monitoring or restrict access to the RMI_PORT. This can be achieved by modifying the solr.in.sh configuration file or configuring firewall rules.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.solr:solr-core.
