PT-2019-4258 · Apache+1 · Apache Solr+1

Michael Stepankin · Published 2019-08-01 · Updated 2025-10-27 · CVE-2019-0193

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Solr versions prior to 8.2.0

Description The DataImportHandler module in Apache Solr has a feature that allows the whole DIH configuration to come from a request's dataConfig parameter. This parameter is a security risk since a DIH config can contain scripts. The debug mode of the DIH admin screen uses this feature, allowing convenient debugging and development of a DIH config. Exploitation of this issue may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 8.2.0, consider disabling the use of the dataConfig parameter until a patch is available. As a temporary workaround, restrict access to the DataImportHandler module to minimize the risk of exploitation. Starting with version 8.2.0, use of the dataConfig parameter requires setting the Java System property enable.dih.dataConfigParam to true, which should be done with caution and only when necessary.

Exploit

Fix

Code Injection

Improper Authentication

Weakness Enumeration

CWE-94

CWE-287

Related Identifiers

BDU:2019-04859

CVE-2019-0193

DLA-1954-1

DLA-2327-1

GHSA-3GM7-V7VW-866C

USN-7283-1

Affected Products

Apache Solr

Ubuntu

References · 73

• 🔥 https://github.com/jas502n/CVE-2019-0193 · Exploit
• 🔥 https://github.com/1135/solr_exploit · Exploit
• 🔥 https://github.com/xConsoIe/CVE-2019-0193 · Exploit
• 🔥❌ https://github.com/jdr2021/ApacheSolrRCE · Exploit, Deleted
• https://cve.org/CVERecord?id=CVE-2019-0193 · Security Note
• https://osv.dev/vulnerability/USN-7283-1 · Vendor Advisory
• https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-0193 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1954-1 · Vendor Advisory
• https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-0193 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7283-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0193 · Security Note
• https://ubuntu.com/security/CVE-2019-0193 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2327-1 · Vendor Advisory