CVE-2017-12629 Apache Solr
| Affected software | Apache Solr |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 2 scores |
| Fixed in | 7.1.0, 6.6.2, 5.5.5 |
| Weakness | XML external entity (XXE) (CWE-611) |
| Published | 14 Oct 2017 |
| Updated | 17 Jun 2026 |
Description
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.
Exploitation status
Working exploit published
A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment no assessment published
- Indexed PoC 4 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Nuclei; first seen 2017-10-17.
- EPSS 92% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full XXE
- Action available security rule
- Review automated Inferred
- Record active
| Decided by | A vulnerability class already blocked by an ARMR security rule |
|---|---|
| Finding | Protected by Waratek's ARMR xxe security rule, which blocks this class of attack at the JVM level without a rule written for this CVE specifically. The CVE's weakness is CWE-611: XML External Entity Reference. |
How to mitigate CVE-2017-12629
Upgrade Apache Solr to a release that fixes it: 7.1.0, 6.6.2 or 5.5.5. Until you can, Waratek RASP blocks exploitation with its XXE rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 2.0 | 7.5 | none | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.solr:solr-core |
7.0.0 | 7.1.0 |
unbounded |
org.apache.solr:solr-core |
6.0.0 | 6.6.2 |
unbounded |
org.apache.solr:solr-core |
5.5.0 | 5.5.5 |
unbounded |
Products and versions
5 products, 12 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | solr | generic | ≥ 5.5.0 and ≤ 5.5.4 · ≥ 6.0.0 and ≤ 6.6.1 · ≥ 7.0.0 and ≤ 7.0.1 |
| nvd | canonical | ubuntu linux | generic | 16.04 |
| nvd | debian | debian linux | generic | 7.0 · 8.0 · 9.0 |
| osv | org.apache.solr | solr-core | generic | ≥ 5.5.0 and ＜ 5.5.5 · ≥ 6.0.0 and ＜ 6.6.2 · ≥ 7.0.0 and ＜ 7.1.0 |
| nvd | redhat | jboss enterprise application platform | generic | 7.0.0 · 7.1.0 |
References
Timeline
Timeline
| Published | 2017-10-14 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |