CVE-2017-12629

CVE-2017-12629 is a critical remote code execution (RCE) vulnerability affecting Apache Solr versions prior to 7.1. It leverages an XML External Entity (XXE) vulnerability in the XML Query Parser, combined with the use of the Config API's add-listener command to invoke the RunExecutableListener class. This allows unauthenticated attackers to execute arbitrary code on the Solr server, read local files, or upload malicious data. The vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. Its EPSS score of 0.93891 indicates a high likelihood of exploitation. While not listed on the KEV catalog, exploit code is publicly available on ExploitDB and through Nuclei templates, with community discussion indicating active interest and the existence of Python-based exploits. Media coverage also confirms its use in coinminer campaigns.