Skip to content
OpenAdvisories
Critical USN-4259-1 1 CVE

Apache Solr vulnerability

Published Jan 29, 2020 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Michael Stepankin and Olga Barinova discovered that Apache Solr was
vulnerable to an XXE attack. An attacker could use this vulnerability to
remotely execute code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS lucene-solr 3.6.2+dfsg-8ubuntu0.1

Vulnerabilities 1

  • Critical 9.8
    CVE-2017-12629 Public exploit Scanner template EPSS 92%

    Remote code execution occurs in Apache Solr

    Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulner…

    org.apache.solr:solr-core lucene-solr lucene-solr Debian Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2017-12629