CVE-2017-12629
Detail
Modified After Enrichment
This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.
Description
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 3.x Severity and Vector Strings:
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 Severity and Vector Strings:
Vector:
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected].
| URL |
Source(s) |
Tag(s) |
|
http://mail-archives.us.apache.org/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3E
|
Apache Software Foundation, CVE |
Mailing List
Vendor Advisory
|
|
http://openwall.com/lists/oss-security/2017/10/13/1
|
Apache Software Foundation, CVE |
Mailing List
Third Party Advisory
|
|
http://www.securityfocus.com/bid/101261
|
Apache Software Foundation, CVE |
Third Party Advisory
VDB Entry
|
|
https://access.redhat.com/errata/RHSA-2017:3123
|
Apache Software Foundation, CVE |
Third Party Advisory
|
|
https://access.redhat.com/errata/RHSA-2017:3124
|
Apache Software Foundation, CVE |
Third Party Advisory
|
|
https://access.redhat.com/errata/RHSA-2017:3244
|
Apache Software Foundation, CVE |
Third Party Advisory
|
|
https://access.redhat.com/errata/RHSA-2017:3451
|
Apache Software Foundation, CVE |
Third Party Advisory
|
|
https://access.redhat.com/errata/RHSA-2017:3452
|
Apache Software Foundation, CVE |
Third Party Advisory
|
|
https://access.redhat.com/errata/RHSA-2018:0002
|
Apache Software Foundation, CVE |
Third Party Advisory
|
|
https://access.redhat.com/errata/RHSA-2018:0003
|
Apache Software Foundation, CVE |
Third Party Advisory
|
|
https://access.redhat.com/errata/RHSA-2018:0004
|
Apache Software Foundation, CVE |
Third Party Advisory
|
|
https://access.redhat.com/errata/RHSA-2018:0005
|
Apache Software Foundation, CVE |
Third Party Advisory
|
|
https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc%40%3Cusers.solr.apache.org%3E
|
Apache Software Foundation, CVE |
|
https://lists.apache.org/thread.html/r26c996b068ef6c5e89aa59acb769025cfd343a08e63fbe9e7f3f720f%40%3Coak-issues.jackrabbit.apache.org%3E
|
Apache Software Foundation, CVE |
|
https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314%40%3Cusers.solr.apache.org%3E
|
Apache Software Foundation, CVE |
|
https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef%40%3Cusers.solr.apache.org%3E
|
Apache Software Foundation, CVE |
|
https://lists.debian.org/debian-lts-announce/2018/01/msg00028.html
|
Apache Software Foundation, CVE |
Mailing List
Third Party Advisory
|
|
https://s.apache.org/FJDl
|
Apache Software Foundation, CVE |
Exploit
Mailing List
Vendor Advisory
|
|
https://twitter.com/ApacheSolr/status/918731485611401216
|
Apache Software Foundation, CVE |
Third Party Advisory
|
|
https://twitter.com/joshbressers/status/919258716297420802
|
Apache Software Foundation, CVE |
Third Party Advisory
|
|
https://twitter.com/searchtools_avi/status/918904813613543424
|
Apache Software Foundation, CVE |
Third Party Advisory
|
|
https://usn.ubuntu.com/4259-1/
|
Apache Software Foundation, CVE |
Third Party Advisory
|
|
https://www.debian.org/security/2018/dsa-4124
|
Apache Software Foundation, CVE |
Third Party Advisory
|
|
https://www.exploit-db.com/exploits/43009/
|
Apache Software Foundation, CVE |
Exploit
Third Party Advisory
VDB Entry
|
Change History
21 change records found show changes
CVE Modified by Apache Software Foundation
6/16/2026 9:03:39 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Affected |
[{"vendor":"n/a","product":"Apache Solr before 7.1 with Apache Lucene before 7.1","versions":[{"version":"Apache Solr before 7.1 with Apache Lucene before 7.1","status":"affected"},{"version":"lucene-solr 7.2.0","status":"unaffected"},{"version":"lucene-solr 8.0.0","status":"unaffected"},{"version":"lucene-solr","lessThan":"7.1.0","versionType":"custom","status":"affected","changes":[{"at":"6.6.2","status":"unaffected"},{"at":"5.5.5","status":"unaffected"}]}]},{"vendor":"n/a","product":"Apache Solr before 7.1 with Apache Lucene before 7.1","platforms":["redhat"],"versions":[{"version":"lucene-solr","lessThan":"5.3.1-redhat-2","versionType":"custom","status":"affected"}]}]
|
CVE Status Change
5/12/2026 8:24:29 PM
| Action |
Type |
Old Value |
New Value |
CVE Modified by CVE
11/20/2024 10:09:55 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
http://mail-archives.us.apache.org/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3E
|
| Added |
Reference |
http://openwall.com/lists/oss-security/2017/10/13/1
|
| Added |
Reference |
http://www.securityfocus.com/bid/101261
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2017:3123
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2017:3124
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2017:3244
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2017:3451
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2017:3452
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2018:0002
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2018:0003
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2018:0004
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2018:0005
|
| Added |
Reference |
https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc%40%3Cusers.solr.apache.org%3E
|
| Added |
Reference |
https://lists.apache.org/thread.html/r26c996b068ef6c5e89aa59acb769025cfd343a08e63fbe9e7f3f720f%40%3Coak-issues.jackrabbit.apache.org%3E
|
| Added |
Reference |
https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314%40%3Cusers.solr.apache.org%3E
|
| Added |
Reference |
https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef%40%3Cusers.solr.apache.org%3E
|
| Added |
Reference |
https://lists.debian.org/debian-lts-announce/2018/01/msg00028.html
|
| Added |
Reference |
https://s.apache.org/FJDl
|
| Added |
Reference |
https://twitter.com/ApacheSolr/status/918731485611401216
|
| Added |
Reference |
https://twitter.com/joshbressers/status/919258716297420802
|
| Added |
Reference |
https://twitter.com/searchtools_avi/status/918904813613543424
|
| Added |
Reference |
https://usn.ubuntu.com/4259-1/
|
| Added |
Reference |
https://www.debian.org/security/2018/dsa-4124
|
| Added |
Reference |
https://www.exploit-db.com/exploits/43009/
|
CVE Modified by Apache Software Foundation
5/14/2024 12:19:08 AM
| Action |
Type |
Old Value |
New Value |
CVE Modified by Apache Software Foundation
11/06/2023 9:38:27 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
Apache Software Foundation https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc%40%3Cusers.solr.apache.org%3E [No types assigned]
|
| Added |
Reference |
Apache Software Foundation https://lists.apache.org/thread.html/r26c996b068ef6c5e89aa59acb769025cfd343a08e63fbe9e7f3f720f%40%3Coak-issues.jackrabbit.apache.org%3E [No types assigned]
|
| Added |
Reference |
Apache Software Foundation https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314%40%3Cusers.solr.apache.org%3E [No types assigned]
|
| Added |
Reference |
Apache Software Foundation https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef%40%3Cusers.solr.apache.org%3E [No types assigned]
|
| Removed |
Reference |
Apache Software Foundation https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc@%3Cusers.solr.apache.org%3E
|
| Removed |
Reference |
Apache Software Foundation https://lists.apache.org/thread.html/r26c996b068ef6c5e89aa59acb769025cfd343a08e63fbe9e7f3f720f@%3Coak-issues.jackrabbit.apache.org%3E
|
| Removed |
Reference |
Apache Software Foundation https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314@%3Cusers.solr.apache.org%3E
|
| Removed |
Reference |
Apache Software Foundation https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef@%3Cusers.solr.apache.org%3E
|
Modified Analysis by NIST
4/19/2022 12:06:34 PM
| Action |
Type |
Old Value |
New Value |
| Changed |
Reference Type |
https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc@%3Cusers.solr.apache.org%3E No Types Assigned
|
https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc@%3Cusers.solr.apache.org%3E Mailing List, Vendor Advisory
|
| Changed |
Reference Type |
https://lists.apache.org/thread.html/r26c996b068ef6c5e89aa59acb769025cfd343a08e63fbe9e7f3f720f@%3Coak-issues.jackrabbit.apache.org%3E No Types Assigned
|
https://lists.apache.org/thread.html/r26c996b068ef6c5e89aa59acb769025cfd343a08e63fbe9e7f3f720f@%3Coak-issues.jackrabbit.apache.org%3E Mailing List, Vendor Advisory
|
| Changed |
Reference Type |
https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314@%3Cusers.solr.apache.org%3E No Types Assigned
|
https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314@%3Cusers.solr.apache.org%3E Mailing List, Vendor Advisory
|
| Changed |
Reference Type |
https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef@%3Cusers.solr.apache.org%3E No Types Assigned
|
https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef@%3Cusers.solr.apache.org%3E Mailing List, Vendor Advisory
|
CVE Modified by Apache Software Foundation
8/17/2021 9:15:08 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
https://lists.apache.org/thread.html/r26c996b068ef6c5e89aa59acb769025cfd343a08e63fbe9e7f3f720f@%3Coak-issues.jackrabbit.apache.org%3E [No Types Assigned]
|
CVE Modified by Apache Software Foundation
7/30/2021 10:15:11 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314@%3Cusers.solr.apache.org%3E [No Types Assigned]
|
CVE Modified by Apache Software Foundation
6/18/2021 12:15:08 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc@%3Cusers.solr.apache.org%3E [No Types Assigned]
|
CVE Modified by Apache Software Foundation
6/18/2021 10:15:07 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef@%3Cusers.solr.apache.org%3E [No Types Assigned]
|
Modified Analysis by NIST
1/27/2021 12:34:04 PM
| Action |
Type |
Old Value |
New Value |
| Added |
CVSS V3.1 |
NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| Removed |
CVSS V3 |
NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| Changed |
CPE Configuration |
AND
OR
*cpe:2.3:a:apache:solr:5.5.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:5.5.1:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:5.5.2:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:5.5.3:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:5.5.4:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.0.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.0.1:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.1.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.2.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.2.1:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.3.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.4.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.4.1:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.4.2:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.5.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.5.1:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.6.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.6.1:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:7.0.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:7.0.1:*:*:*:*:*:*:*
OR
cpe:2.3:a:apache:lucene:*:*:*:*:*:*:*:* versions up to (including) 7.0.1
|
OR
*cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* versions from (including) 5.5.0 up to (including) 5.5.4
*cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* versions from (including) 6.0.0 up to (including) 6.6.1
*cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* versions from (including) 7.0.0 up to (including) 7.0.1
|
| Added |
CPE Configuration |
AND
OR
*cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*
*cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*
OR
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
|
| Added |
CPE Configuration |
OR
*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
|
| Added |
CPE Configuration |
OR
*cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
|
| Changed |
Reference Type |
http://mail-archives.us.apache.org/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3E Exploit, Mailing List, Vendor Advisory
|
http://mail-archives.us.apache.org/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3E Mailing List, Vendor Advisory
|
| Changed |
Reference Type |
https://access.redhat.com/errata/RHSA-2017:3123 No Types Assigned
|
https://access.redhat.com/errata/RHSA-2017:3123 Third Party Advisory
|
| Changed |
Reference Type |
https://access.redhat.com/errata/RHSA-2017:3124 No Types Assigned
|
https://access.redhat.com/errata/RHSA-2017:3124 Third Party Advisory
|
| Changed |
Reference Type |
https://access.redhat.com/errata/RHSA-2017:3244 No Types Assigned
|
https://access.redhat.com/errata/RHSA-2017:3244 Third Party Advisory
|
| Changed |
Reference Type |
https://access.redhat.com/errata/RHSA-2017:3451 No Types Assigned
|
https://access.redhat.com/errata/RHSA-2017:3451 Third Party Advisory
|
| Changed |
Reference Type |
https://access.redhat.com/errata/RHSA-2017:3452 No Types Assigned
|
https://access.redhat.com/errata/RHSA-2017:3452 Third Party Advisory
|
| Changed |
Reference Type |
https://access.redhat.com/errata/RHSA-2018:0002 No Types Assigned
|
https://access.redhat.com/errata/RHSA-2018:0002 Third Party Advisory
|
| Changed |
Reference Type |
https://access.redhat.com/errata/RHSA-2018:0003 No Types Assigned
|
https://access.redhat.com/errata/RHSA-2018:0003 Third Party Advisory
|
| Changed |
Reference Type |
https://access.redhat.com/errata/RHSA-2018:0004 No Types Assigned
|
https://access.redhat.com/errata/RHSA-2018:0004 Third Party Advisory
|
| Changed |
Reference Type |
https://access.redhat.com/errata/RHSA-2018:0005 No Types Assigned
|
https://access.redhat.com/errata/RHSA-2018:0005 Third Party Advisory
|
| Changed |
Reference Type |
https://lists.debian.org/debian-lts-announce/2018/01/msg00028.html No Types Assigned
|
https://lists.debian.org/debian-lts-announce/2018/01/msg00028.html Mailing List, Third Party Advisory
|
| Changed |
Reference Type |
https://usn.ubuntu.com/4259-1/ No Types Assigned
|
https://usn.ubuntu.com/4259-1/ Third Party Advisory
|
| Changed |
Reference Type |
https://www.debian.org/security/2018/dsa-4124 No Types Assigned
|
https://www.debian.org/security/2018/dsa-4124 Third Party Advisory
|
CVE Modified by Apache Software Foundation
1/31/2020 9:15:11 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
https://usn.ubuntu.com/4259-1/ [No Types Assigned]
|
CVE Modified by Apache Software Foundation
2/28/2018 9:29:00 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
https://www.debian.org/security/2018/dsa-4124 [No Types Assigned]
|
CVE Modified by Apache Software Foundation
2/03/2018 9:29:08 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
https://lists.debian.org/debian-lts-announce/2018/01/msg00028.html [No Types Assigned]
|
CVE Modified by Apache Software Foundation
1/04/2018 9:31:29 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2018:0002 [No Types Assigned]
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2018:0003 [No Types Assigned]
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2018:0004 [No Types Assigned]
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2018:0005 [No Types Assigned]
|
CVE Modified by Apache Software Foundation
12/13/2017 9:29:08 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2017:3451 [No Types Assigned]
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2017:3452 [No Types Assigned]
|
CVE Modified by Apache Software Foundation
12/01/2017 9:29:06 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2017:3123 [No Types Assigned]
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2017:3124 [No Types Assigned]
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2017:3244 [No Types Assigned]
|
Initial Analysis by NIST
11/07/2017 11:00:39 AM
| Action |
Type |
Old Value |
New Value |
| Added |
CVSS V3 |
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| Added |
CVSS V2 |
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
|
| Added |
CWE |
CWE-611
|
| Added |
CPE Configuration |
AND
OR
*cpe:2.3:a:apache:solr:5.5.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:5.5.1:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:5.5.2:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:5.5.3:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:5.5.4:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.0.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.0.1:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.1.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.2.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.2.1:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.3.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.4.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.4.1:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.4.2:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.5.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.5.1:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.6.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:6.6.1:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:7.0.0:*:*:*:*:*:*:*
*cpe:2.3:a:apache:solr:7.0.1:*:*:*:*:*:*:*
OR
cpe:2.3:a:apache:lucene:7.0.1:*:*:*:*:*:*:* (and previous)
|
| Changed |
Reference Type |
http://mail-archives.us.apache.org/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3E No Types Assigned
|
http://mail-archives.us.apache.org/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3E Exploit, Mailing List, Vendor Advisory
|
| Changed |
Reference Type |
http://openwall.com/lists/oss-security/2017/10/13/1 No Types Assigned
|
http://openwall.com/lists/oss-security/2017/10/13/1 Mailing List, Third Party Advisory
|
| Changed |
Reference Type |
http://www.securityfocus.com/bid/101261 No Types Assigned
|
http://www.securityfocus.com/bid/101261 Third Party Advisory, VDB Entry
|
| Changed |
Reference Type |
https://s.apache.org/FJDl No Types Assigned
|
https://s.apache.org/FJDl Exploit, Mailing List, Vendor Advisory
|
| Changed |
Reference Type |
https://twitter.com/ApacheSolr/status/918731485611401216 No Types Assigned
|
https://twitter.com/ApacheSolr/status/918731485611401216 Third Party Advisory
|
| Changed |
Reference Type |
https://twitter.com/joshbressers/status/919258716297420802 No Types Assigned
|
https://twitter.com/joshbressers/status/919258716297420802 Third Party Advisory
|
| Changed |
Reference Type |
https://twitter.com/searchtools_avi/status/918904813613543424 No Types Assigned
|
https://twitter.com/searchtools_avi/status/918904813613543424 Third Party Advisory
|
| Changed |
Reference Type |
https://www.exploit-db.com/exploits/43009/ No Types Assigned
|
https://www.exploit-db.com/exploits/43009/ Exploit, Third Party Advisory, VDB Entry
|
CVE Modified by Apache Software Foundation
10/26/2017 9:29:00 PM
| Action |
Type |
Old Value |
New Value |
| Changed |
Description |
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this.
|
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.
|
| Added |
Reference |
http://mail-archives.us.apache.org/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3E [No Types Assigned]
|
| Added |
Reference |
https://s.apache.org/FJDl [No Types Assigned]
|
CVE Modified by Apache Software Foundation
10/19/2017 9:29:12 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
https://www.exploit-db.com/exploits/43009/ [No Types Assigned]
|
CVE Modified by Apache Software Foundation
10/15/2017 9:29:00 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
http://www.securityfocus.com/bid/101261 [No Types Assigned]
|
Quick Info
CVE Dictionary Entry: CVE-2017-12629 NVD
Published Date: 10/14/2017 NVD
Last Modified: 06/16/2026
Source: Apache Software Foundation
|
