Read the docs
TI-2019-13101 Aliases CVE-2019-17558GHSA-ww97-9w65-2crx

Injection in Apache Solr

Priority CRITICAL 92Exploited in the wildCWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).

Why it matters now

Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03
EPSS 0.98567 99th percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by NVD
Fix Fixed org.apache.solr:solr-core (Maven): 8.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache SolrApache Solr 5.0.0 to Apache Solr 8.3.1—No fix listedCNA
—org.apache.solr:solr-core (Maven)5.0.0 to before 8.4.08.4.0Patch availableGHSA-ww97-9w65-2crx
—org.apache.solr:solr-core (Maven)6.0.0 to before 8.4.08.4.0Patch availableGHSA-ww97-9w65-2crx
—org.apache.solr:solr-core (Maven)7.0.0 to before 8.4.08.4.0Patch availableGHSA-ww97-9w65-2crx
—org.apache.solr:solr-core (Maven)8.0.0 to before 8.4.08.4.0Patch availableGHSA-ww97-9w65-2crx
  • Apache Solr Vendor— Affected Apache Solr 5.0.0 to Apache Solr 8.3.1 Fixed in — No fix listed CNA
  • org.apache.solr:solr-core (Maven) Vendor— Affected 5.0.0 to before 8.4.0 Fixed in 8.4.0 Patch available GHSA-ww97-9w65-2crx
  • org.apache.solr:solr-core (Maven) Vendor— Affected 6.0.0 to before 8.4.0 Fixed in 8.4.0 Patch available GHSA-ww97-9w65-2crx
  • org.apache.solr:solr-core (Maven) Vendor— Affected 7.0.0 to before 8.4.0 Fixed in 8.4.0 Patch available GHSA-ww97-9w65-2crx
  • org.apache.solr:solr-core (Maven) Vendor— Affected 8.0.0 to before 8.4.0 Fixed in 8.4.0 Patch available GHSA-ww97-9w65-2crx

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*5.0.0 to before 7.7.3; 8.0.0 to before 8.4.0VulnerableApache
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*17.7 – 17.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*16.1VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*16.2VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*18.8VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*19.12VulnerableOracle
  • cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* Versions 5.0.0 to before 7.7.3; 8.0.0 to before 8.4.0 Vulnerable ·Apache
  • cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* Versions 16.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-ww97-9w65-2crx org.apache.solr:solr-core (Maven) Fixed in 8.4.0 Advisory →
  • Fix · GHSA-ww97-9w65-2crx org.apache.solr:solr-core (Maven) Fixed in 8.4.0 Advisory →
  • Fix · GHSA-ww97-9w65-2crx org.apache.solr:solr-core (Maven) Fixed in 8.4.0 Advisory →
  • Fix · GHSA-ww97-9w65-2crx org.apache.solr:solr-core (Maven) Fixed in 8.4.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Fuse 6
  • Red Hat JBoss Fuse Service Works 6

Timeline

  1. 2021-11-03 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2019-17558
  3. 2026-10-03 Alias added: GHSA-ww97-9w65-2crx

References

Exploit 4

Advisory 2

Other 54

  • TI-2024-30303 Apache Solr: Authentication bypass possible using a fake URL Path ending CVSS 3.1CRITICAL 9.8
  • TI-2019-00170 Code injection in Apache Solr KEVCVSS 3.1HIGH 7.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2021-09240 SSRF vulnerability with the Replication handler CVSS 3.1CRITICAL 9.8
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
  • TI-2020-10933 Incorrect authorization in Apache Solr CVSS 3.1CRITICAL 9.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences