CVE-2017-12629

🗓️ 14 Oct 2017 21:00:00Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 388 Views🌐 WEB

Remote code execution in Apache Solr before 7.1 via XXE exploitation and Config API add-listener command, affecting XML Query Parser and RunExecutableListener

Reporter	Title	Published	Views	Family All 110
Gitee	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat	16 May 202116:14	–	gitee
Gitee	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat	27 Apr 202114:33	–	gitee
Gitee	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat	22 Oct 202115:45	–	gitee
Gitee	Exploit for Improper Restriction of XML External Entity Reference in Apache Solr	7 Mar 202111:09	–	gitee
Gitee	Exploit for OS Command Injection in Gnu Bash	27 Jul 202504:21	–	gitee
Gitee	Exploit for Improper Restriction of XML External Entity Reference in Apache Solr	16 Aug 202116:49	–	gitee
zdt	Apache Solr 7.0.1 - XML External Entity Expansion / Remote Code Execution Vulnerability	18 Oct 201700:00	–	zdt
IBM Security Bulletins	Security Bulletin: A vulnerability in Apache Solr affects IBM InfoSphere Information Server	3 Apr 201923:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere BigInsights 4.2.5 is affected by an Open Source (Solr) vulnerabilty (CVE-2017-12629)	18 Jul 202023:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 8.0.2	18 Jun 202414:02	–	ibm

NVD

Vulners

Node

apache solrRange5.5.0–5.5.4

apache solrRange6.0.0–6.6.1

apache solrRange7.0.0–7.0.1

Node

AND

redhat jboss_enterprise_application_platformMatch7.0.0

redhat jboss_enterprise_application_platformMatch7.1.0

redhat enterprise_linux_serverMatch6.0

redhat enterprise_linux_serverMatch7.0

Node

debian debian_linuxMatch7.0

debian debian_linuxMatch8.0

debian debian_linuxMatch9.0

Node

canonical ubuntu_linuxMatch16.04lts

[
  {
    "product": "Apache Solr before 7.1 with Apache Lucene before 7.1",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Apache Solr before 7.1 with Apache Lucene before 7.1"
      },
      {
        "status": "unaffected",
        "version": "lucene-solr 7.2.0"
      },
      {
        "status": "unaffected",
        "version": "lucene-solr 8.0.0"
      },
      {
        "changes": [
          {
            "at": "6.6.2",
            "status": "unaffected"
          },
          {
            "at": "5.5.5",
            "status": "unaffected"
          }
        ],
        "lessThan": "7.1.0",
        "status": "affected",
        "version": "lucene-solr",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "redhat"
    ],
    "product": "Apache Solr before 7.1 with Apache Lucene before 7.1",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "5.3.1-redhat-2",
        "status": "affected",
        "version": "lucene-solr",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
debian	www.debian.org/security/2018/dsa-4124
access	www.access.redhat.com/errata/RHSA-2017:3451
access	www.access.redhat.com/errata/RHSA-2018:0005
lists	www.lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc%40%3Cusers.solr.apache.org%3E
access	www.access.redhat.com/errata/RHSA-2017:3244
securityfocus	www.securityfocus.com/bid/101261
access	www.access.redhat.com/errata/RHSA-2017:3123
access	www.access.redhat.com/errata/RHSA-2018:0003
lists	www.lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314%40%3Cusers.solr.apache.org%3E
lists	www.lists.debian.org/debian-lts-announce/2018/01/msg00028.html

Parameter	Position	Path	Description	CWE
q	query param	solr/gettingstarted/select	XXE via xmlparser in Solr query parser allows external entity resolution to reach local resources or attacker-controlled endpoints.	CWE-611
add-listener	request body	solr/newcollection/config	Remote code execution by configuring RunExecutableListener through the Config API add-listener payload.	CWE-611
event	request body	solr/newcollection/config	Remote code execution by configuring RunExecutableListener through the Config API add-listener payload.	CWE-611
name	request body	solr/newcollection/config	Remote code execution by configuring RunExecutableListener through the Config API add-listener payload.	CWE-611
class	request body	solr/newcollection/config	Remote code execution by configuring RunExecutableListener through the Config API add-listener payload.	CWE-611
exe	request body	solr/newcollection/config	Remote code execution by configuring RunExecutableListener through the Config API add-listener payload.	CWE-611
dir	request body	solr/newcollection/config	Remote code execution by configuring RunExecutableListener through the Config API add-listener payload.	CWE-611
args	request body	solr/newcollection/config	Remote code execution by configuring RunExecutableListener through the Config API add-listener payload.	CWE-611
[{"id":"test"}]	request body	solr/newcollection/update	Trigger execution of a configured RunExecutableListener on update by sending an exploit payload to the update endpoint.	CWE-611

17 Jun 2026 01:03Current

9.6High risk

Vulners AI Score9.6

CVSS 27.5

CVSS 3.19.8

EPSS0.91896

CWE-611