2 lines
7.2 KiB
JSON
2 lines
7.2 KiB
JSON
{"affected":[{"affectedData":[{"product":"Apache Solr","vendor":"Apache Software Foundation","versions":[{"status":"affected","version":"Apache Solr 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5"}]}],"source":"security@apache.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*","matchCriteriaId":"50F420BE-F670-4C2E-BC9E-7198EC88E165","versionEndIncluding":"5.5.5","versionStartIncluding":"5.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*","matchCriteriaId":"4015560B-9475-4F31-994B-5BA3E7D8B2AB","versionEndIncluding":"6.6.5","versionStartIncluding":"6.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*","matchCriteriaId":"7B7A6697-98CC-4E36-93DB-B7160F8399F9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side."},{"lang":"es","value":"En Apache Solr, desde la versión 5.0.0 hasta la 6.0.0 y desde la 6.0.0 hasta la 6.6.5, el API Config permite la configuración del servidor JMX con una petición HTTP POST. Al redirigirlo a un servidor RMI malicioso, un atacante podría aprovecharse de la deserialización insegura de Solr para desencadenar una ejecución remota de código en el lado de Solr.."}],"id":"CVE-2019-0192","lastModified":"2026-06-17T02:07:55.243","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2019-03-07T21:29:00.203","references":[{"source":"security@apache.org","tags":["Mailing List","Mitigation","Vendor Advisory"],"url":"http://mail-archives.us.apache.org/mod_mbox/www-announce/201903.mbox/%3CCAECwjAV1buZwg%2BMcV9EAQ19MeAWztPVJYD4zGK8kQdADFYij1w%40mail.gmail.com%3E"},{"source":"security@apache.org","tags":["Third Party Advisory","VDB Entry"],"url":"http://www.securityfocus.com/bid/107318"},{"source":"security@apache.org","url":"https://access.redhat.com/errata/RHSA-2019:2413"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/42c5682f4acd1d03bd963e4f47ae448d7cff66c16b19142773818892%40%3Cdev.lucene.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/53e4744b14fb7f1810405f8ff5531ab0953a23dd09ce8071ce87e00d%40%3Cdev.lucene.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/b0ace855f569c6b7a0b03ba68566e53b1a1a519abd536bf38978ce4a%40%3Cdev.lucene.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/d0e608c681dfbb16b4da68d99d43fa0ddbd366bb3bcf5bc0d43c56d7%40%3Cdev.lucene.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/ec9c572fb803b26ba0318777977ee6d6a2fb3a2c50d9b4224e541d5d%40%3Cdev.lucene.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/rc400db37710ee79378b6c52de3640493ff538c2beb41cefdbbdf2ab8%40%3Ccommits.submarine.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E"},{"source":"security@apache.org","tags":["Third Party Advisory"],"url":"https://security.netapp.com/advisory/ntap-20190327-0003/"},{"source":"security@apache.org","url":"https://www.oracle.com/security-alerts/cpuoct2020.html"},{"source":"security@apache.org","url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Mitigation","Vendor Advisory"],"url":"http://mail-archives.us.apache.org/mod_mbox/www-announce/201903.mbox/%3CCAECwjAV1buZwg%2BMcV9EAQ19MeAWztPVJYD4zGK8kQdADFYij1w%40mail.gmail.com%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"url":"http://www.securityfocus.com/bid/107318"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://access.redhat.com/errata/RHSA-2019:2413"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/42c5682f4acd1d03bd963e4f47ae448d7cff66c16b19142773818892%40%3Cdev.lucene.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/53e4744b14fb7f1810405f8ff5531ab0953a23dd09ce8071ce87e00d%40%3Cdev.lucene.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/b0ace855f569c6b7a0b03ba68566e53b1a1a519abd536bf38978ce4a%40%3Cdev.lucene.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/d0e608c681dfbb16b4da68d99d43fa0ddbd366bb3bcf5bc0d43c56d7%40%3Cdev.lucene.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/ec9c572fb803b26ba0318777977ee6d6a2fb3a2c50d9b4224e541d5d%40%3Cdev.lucene.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/rc400db37710ee79378b6c52de3640493ff538c2beb41cefdbbdf2ab8%40%3Ccommits.submarine.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://security.netapp.com/advisory/ntap-20190327-0003/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.oracle.com/security-alerts/cpuoct2020.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"nvd@nist.gov","type":"Primary"}]}
|