CVE-2019-0192observed exploitation

CVE-2019-0192

82Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 78%

from disclosure to weapon3 days

Published on NVDMar 7

1st PoC+3d

VulnCheck+767d

exploitation probability

78%top 1% of all CVEs

observed exploitation

yesVulnCheck

2 public exploit(s)

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.

Affected products

Apache Software Foundation · Apache Solr

public PoCs found — 2

vulncheckvulncheck.com/xdb/54759569be2dunverified vulncheckvulncheck.com/xdb/8be89dc68d9funverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References