CVE-2019-12409: Apache Solr RCE vulnerability due to bad config default

{
  "id": "6e1ebba37e9b0dc515ae4444c4f8be15386894fc4baef54907d41469c55e4474",
  "url": "https://solr.apache.org/cve-2019-12409-apache-solr-rce-vulnerability-due-to-bad-config-default.html",
  "method": "llm",
  "payload": {
    "kind": "mitigation",
    "title": "CVE-2019-12409: Apache Solr RCE vulnerability due to bad config default",
    "summary": "The default solr.in.sh configuration in the affected Linux releases can expose unauthenticated JMX on the RMI port, potentially allowing remote code execution if the port is reachable. Set ENABLE_REMOTE_JMX_OPTS to 'false' on every Solr node and restart Solr; no code upgrade is needed.",
    "evidence": "Make sure your effective solr.in.sh file has ENABLE_REMOTE_JMX_OPTS set to 'false' on every Solr node and then restart Solr.",
    "products": [
      {
        "name": {
          "value": "Apache Solr",
          "evidence": "The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting"
        },
        "prerequisites": [
          {
            "value": "If you use the default solr.in.sh file from the affected releases",
            "evidence": "If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication."
          },
          {
            "value": "If this port is opened for inbound traffic in your firewall",
            "evidence": "If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX"
          }
        ],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "Solr 8.1.1 and 8.2.0 for Linux",
            "evidence": "Versions Affected: Solr 8.1.1 and 8.2.0 for Linux"
          }
        ]
      }
    ],
    "severity": "high",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2019-12409",
        "evidence": "CVE-2019-12409: Apache Solr RCE vulnerability due to bad config default"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "Severity: High"
  },
  "source_id": "official-apache-solr-security",
  "document_id": 22992,
  "published_at": "2019-11-18T00:00:00+00:00"
}