Live › vulnerability › CVE-2019-0193
Go to dashboardApache Solr's optional DataImportHandler module contains a code injection flaw. Per the sources, an attacker can get code executed on the Solr server; the sources do not say whether authentication is needed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Apache Solr | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
s advisory (CISA says apply updates per vendor instructions'; the fixed version is unknown from these sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
This page as .md · .json · in your agent: get_signal("CVE-2019-0193")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.