Log in Start free

Actively exploited · Published Aug 1, 2019 · Assigned by apache

CVE-2019-0193

High 7.2 Exploited

In plain English

A high-severity code injection in Apache Solr from Apache. Attackers are actively exploiting it in the wild (listed by CISA on December 10, 2021). The chance it is exploited in the next 30 days is estimated at 83.5% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)83.5%top 0.3% of all CVEs
Exploited in the wildYesCISA KEV since Dec 10, 2021
Attack tooling2Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 10, 2022.

Official description

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12lucene-solr3.6.2+dfsg-22DEBIAN-CVE-2019-0193
Debian:13lucene-solr3.6.2+dfsg-22DEBIAN-CVE-2019-0193
Debian:14lucene-solr3.6.2+dfsg-22DEBIAN-CVE-2019-0193
Mavenorg.apache.solr:solr-core8.2.0GHSA-3gm7-v7vw-866c

Affected products (as reported)

VendorProductVersions
Apache Apache Solr Apache Solr all prior to 8.2.0

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References