CVE-2017-12629

Exploitation

Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.

SSVC decision

Not assessed by CISA

EPSS probability

91.90% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 99.8% of scored records. A rank, not a probability.

NVD base score

9.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Critical. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2017-10-14 21:00Z8 YR AGO

Last updated

2024-08-05 18:43Z2 YR AGO

Reserved

2017-08-07

Assigning CNA

apache

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

• CWE-611Improper Restriction of XML External Entity ReferenceBase
• CWE-138Improper Neutralization of Special ElementsClass

Data version

5.1

Document digest

fd7c5e95ced182ada082ee3eb516d00371ef4844b5fc37f432b1a3a9f98034bf

• access.redhat.comRHSA-2017:3451https://access.redhat.com/errata/RHSA-2017:3451vendor-advisoryx_refsource_REDHAT
• s.apache.org[lucene-dev] 20171012 Re: Several critical vulnerabilities discovered in Apache Solr (XXE & RCE)https://s.apache.org/FJDlmailing-listx_refsource_MLIST
• access.redhat.comRHSA-2018:0002https://access.redhat.com/errata/RHSA-2018:0002vendor-advisoryx_refsource_REDHAT
• www.securityfocus.com101261http://www.securityfocus.com/bid/101261vdb-entryx_refsource_BID
• access.redhat.comRHSA-2018:0004https://access.redhat.com/errata/RHSA-2018:0004vendor-advisoryx_refsource_REDHAT
• access.redhat.comRHSA-2017:3452https://access.redhat.com/errata/RHSA-2017:3452vendor-advisoryx_refsource_REDHAT
• lists.debian.org[debian-lts-announce] 20180121 [SECURITY] [DLA 1254-1] lucene-solr security updatehttps://lists.debian.org/debian-lts-announce/2018/01/msg00028.htmlmailing-listx_refsource_MLIST
• www.exploit-db.com43009https://www.exploit-db.com/exploits/43009/exploitx_refsource_EXPLOIT-DB
• access.redhat.comRHSA-2018:0003https://access.redhat.com/errata/RHSA-2018:0003vendor-advisoryx_refsource_REDHAT
• access.redhat.comRHSA-2017:3123https://access.redhat.com/errata/RHSA-2017:3123vendor-advisoryx_refsource_REDHAT
• access.redhat.comRHSA-2018:0005https://access.redhat.com/errata/RHSA-2018:0005vendor-advisoryx_refsource_REDHAT
• access.redhat.comRHSA-2017:3244https://access.redhat.com/errata/RHSA-2017:3244vendor-advisoryx_refsource_REDHAT
• access.redhat.comRHSA-2017:3124https://access.redhat.com/errata/RHSA-2017:3124vendor-advisoryx_refsource_REDHAT
• mail-archives.us.apache.org[www-announce] 20171019 [SECURITY] CVE-2017-12629: Several critical vulnerabilities discovered in Apache Solr (XXE & RCE)http://mail-archives.us.apache.org/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3Emailing-listx_refsource_MLIST
• www.debian.orgDSA-4124https://www.debian.org/security/2018/dsa-4124vendor-advisoryx_refsource_DEBIAN
• usn.ubuntu.comUSN-4259-1https://usn.ubuntu.com/4259-1/vendor-advisoryx_refsource_UBUNTU
• twitter.comhttps://twitter.com/ApacheSolr/status/918731485611401216x_refsource_MISC
• twitter.comhttps://twitter.com/searchtools_avi/status/918904813613543424x_refsource_MISC
• openwall.comhttp://openwall.com/lists/oss-security/2017/10/13/1x_refsource_MISC
• twitter.comhttps://twitter.com/joshbressers/status/919258716297420802x_refsource_MISC
• lists.apache.org[solr-users] 20210618 CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerabilityhttps://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef%40%3Cusers.solr.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[solr-users] 20210618 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerabilityhttps://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc%40%3Cusers.solr.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[solr-users] 20210728 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerabilityhttps://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314%40%3Cusers.solr.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[jackrabbit-oak-issues] 20210817 [jira] [Created] (OAK-9537) Security vulnerability in org/apache/lucene/queryparser/xml/CoreParser.javahttps://lists.apache.org/thread.html/r26c996b068ef6c5e89aa59acb769025cfd343a08e63fbe9e7f3f720f%40%3Coak-issues.jackrabbit.apache.org%3Emailing-listx_refsource_MLIST