Read the docs
TI-2019-00170 Aliases CVE-2019-0193GHSA-3gm7-v7vw-866c

Code injection in Apache Solr

Priority CRITICAL 91Exploited in the wildCWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.

Summary

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.

Why it matters now

Exploitation Active In CISA KEV since 2021-12-10CISA due date 2022-06-10
EPSS 0.83547 99th percentileScored 2026-11-07
Fix Partial org.apache.solr:solr-core (Maven): 8.2.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache SolrApache Solr all prior to 8.2.0—No fix listedCNA
—org.apache.solr:solr-core (Maven)before 8.2.08.2.0Patch availableGHSA-3gm7-v7vw-866c
  • Apache Solr VendorApache Affected Apache Solr all prior to 8.2.0 Fixed in — No fix listed CNA
  • org.apache.solr:solr-core (Maven) Vendor— Affected before 8.2.0 Fixed in 8.2.0 Patch available GHSA-3gm7-v7vw-866c

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*before 7.7.3; 8.1.0 to before 8.1.2VulnerableApache
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
  • cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* Versions before 7.7.3; 8.1.0 to before 8.1.2 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-3gm7-v7vw-866c org.apache.solr:solr-core (Maven) Fixed in 8.2.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Not affected: 4 products
  • Red Hat Fuse 7
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Fuse 6

Timeline

  1. 2021-12-10 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2019-0193
  3. 2026-10-03 Alias added: GHSA-3gm7-v7vw-866c

References

Patch 2

Advisory 4

Other 39

  • TI-2024-30303 Apache Solr: Authentication bypass possible using a fake URL Path ending CVSS 3.1CRITICAL 9.8
  • TI-2019-13101 Injection in Apache Solr KEVCVSS 3.1HIGH 7.5
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2021-09240 SSRF vulnerability with the Replication handler CVSS 3.1CRITICAL 9.8
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
  • TI-2020-10933 Incorrect authorization in Apache Solr CVSS 3.1CRITICAL 9.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences