critical
CVE-2017-12629
Apache Solr before 7.1.0: a RunExecutableListener can be added through the config API and then fired by any document update, giving remote command execution; the same id also covers the XXE in the XML query parser that reaches it
- Severity
- critical
- Affected product
- Apache Solr
- Affected versions
- Apache Solr < 7.1.0
- Fixed in
- Apache Solr 7.1.0
- Detection basis
- Component version range
- Shipped rule
- Apache Solr: Apache Solr before 7.1.0: a RunExecutableListener can be added through the config API and then fired by any document update, giving remote command execution; the same id also covers the XXE in the XML query parser that reaches it
- Added to NewScan
- 2026-10-15
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints Apache Solr from its response and reports this CVE when the detected version falls inside the affected range below.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.