HackerFeeds
All CVEs

CVE-2019-0193

HIGH7.2
CISA KEV

Published 2019-08-01 · Updated 2026-06-17 · Source security@apache.org

Summary

CVE-2019-0193 is a high-severity (CVSS 7.2) vulnerability in Apache Solr. CISA added it to the Known Exploited Vulnerabilities catalog on December 10, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 10, 2022. CISA does not currently list it as used in ransomware campaigns. Apache has 41 vulnerabilities in the KEV catalog, 8 of them linked to ransomware.

All 41 known-exploited Apache vulnerabilities →

Description

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-94CWE-94

CISA Known-Exploited Vulnerability

Product: Apache — Solr

Name: Apache Solr DataImportHandler Code Injection Vulnerability

Date added: 2021-12-10 · Due: 2022-06-10

Required action: Apply updates per vendor instructions.

References

View on NVD