Vulnerability in Apache Solr
CVE-2019-0193
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of…
EPSS: 0.931 (99.8th percentile) — read the EPSS interpretation.
Affected products
- Apache Solr — versions Apache Solr all prior to 8.2.0
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply updates per vendor instructions.
Public proof-of-concept exploits
References
- issues.apache.org/jira/browse/SOLR-13669 (x_refsource_CONFIRM)
- [debian-lts-announce] 20191010 [SECURITY] [DLA 1954-1] lucene-solr security update (mailing-list, x_refsource_MLIST)
- [lucene-issues] 20191025 [jira] [Updated] (SOLR-13873) Is there any fix for CVE-2019-0193 issue for solr 7.7.1 (mailing-list, x_refsource_MLIST)
- [lucene-issues] 20191025 [jira] [Created] (SOLR-13873) Is there any fix for CVE-2019-0193 issue for solr 7.7.1 (mailing-list, x_refsource_MLIST)
- [lucene-issues] 20191025 [jira] [Resolved] (SOLR-13873) Is there any fix for CVE-2019-0193 issue for solr 7.7.1 (mailing-list, x_refsource_MLIST)
- [lucene-issues] 20191025 [jira] [Commented] (SOLR-13669) [CVE-2019-0193] Remote Code Execution via DataImportHandler (mailing-list, x_refsource_MLIST)
- [lucene-issues] 20191025 [jira] [Commented] (SOLR-13873) Is there any fix for CVE-2019-0193 issue for solr 7.7.1 (mailing-list, x_refsource_MLIST)
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html (mailing-list, x_refsource_MLIST)
- [lucene-issues] 20191129 [jira] [Commented] (SOLR-13669) [CVE-2019-0193] Remote Code Execution via DataImportHandler (mailing-list, x_refsource_MLIST)
- [lucene-issues] 20191130 [jira] [Resolved] (SOLR-13669) [CVE-2019-0193] Remote Code Execution via DataImportHandler (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2019-0193?
- CVE-2019-0193 is a vulnerability in Apache Solr. Published 2019-08-01.
- Is CVE-2019-0193 known to be exploited?
- Yes. CVE-2019-0193 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-12-10), indicating it is being actively exploited. 62 public proof-of-concept repositories are indexed.