CVE-2019-17558

Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability

Solr

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that…

30. Dez 2019

Ausgewertete Quellen

• Hersteller
  https://issues.apache.org/jira/browse/SOLR-13971
• Hinweis
  http://packetstormsecurity.com/files/157078/Apache-Solr-8.3.0-Velocity-Template-Remote-Code-Execution.html
• Hinweis
  https://www.oracle.com/security-alerts/cpuoct2020.html
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-17558
• CISA
  Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability
• NVD
  CVE-2019-17558