{"id":"CVE-2019-0193","kind":"vulnerability","aliases":["CVE-2019-0193"],"related":[],"title":"Apache Solr: Apache Solr DataImportHandler Code Injection Vulnerability","description":"In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's \"dataConfig\" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property \"enable.dih.dataConfigParam\" to true.","summary":"Apache Solr's optional DataImportHandler module contains a code injection flaw. Per the sources, an attacker can get code executed on the Solr server; the sources do not say whether authentication is needed.","severity":"critical","cvss":9.0,"epss":0.83547,"exploited":true,"exploited_at":"2021-12-10T00:00:00+00:00","products":[{"name":"Apache Solr","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache-solr","exploited","java","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":null,"fix":"Apply the vendor update per Apache Solr's advisory (CISA says 'apply updates per vendor instructions'; the fixed version is unknown from these sources).\nIf DataImportHandler is not used, disabling or removing it is a likely mitigation, but the sources do not confirm this.","status":"open","published_at":"2019-08-01T14:15:13+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:31:54+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:31:54Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per Apache Solr's advisory (CISA says 'apply updates per vendor instructions'; the fixed version is unknown from these sources).\nIf DataImportHandler is not used, disabling or removing it is a likely mitigation, but the sources do not confirm this.","reach":"network","impact":"high","summary":"Apache Solr's optional DataImportHandler module contains a code injection flaw. Per the sources, an attacker can get code executed on the Solr server; the sources do not say whether authentication is needed.","category":"package","who_cares":["apache-solr","self-hosted","java"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the Solr server via DataImportHandler","analyst_note":"Find the affected and fixed Solr versions and the DataImportHandler mitigation steps in Apache's CVE-2019-0193 advisory; the sources give neither.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000477,"input_tokens":2805,"output_tokens":393,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the affected and fixed Solr versions and the DataImportHandler mitigation steps in Apache's CVE-2019-0193 advisory; the sources give neither.","search":"'-0193':11A,14A '-2019':10A,13A '8.2.0':130C 'admin':101C 'allow':106C 'apach':1A,3A,18B,26B,60C 'apache':15A 'apache-solr':17B 'attack':41B 'authent':56B 'code':6A,34B,44B 'come':88C 'config':113C,117C 'configur':86C 'contain':32B,119C 'conveni':107C 'cve':9A,12A 'data':72C 'databas':74C 'dataconfig':93C 'dataimporthandl':5A,30B,63C 'debug':96C,108C 'develop':109C 'dih':85C,100C,112C,116C 'enable.dih.dataconfigparam':143C 'execut':45B 'exploit':20B 'featur':80C 'flaw':36B 'get':43B 'host':25B 'inject':7A,35B 'java':21B,140C 'mode':97C 'modul':31B,68C 'need':58B 'option':29B,65C 'packag':22B 'paramet':94C,122C,136C 'per':37B 'popular':67C 'properti':142C 'pull':70C 'request':91C 'requir':137C 'risk':126C 'say':54B 'screen':102C 'script':120C 'secur':125C 'self':24B 'self-host':23B 'server':49B 'set':138C 'sinc':114C 'solr':2A,4A,16A,19B,27B,48B,61C,132C 'sourc':39B,51B,77C 'start':127C 'system':141C 'true':145C 'use':103C,133C 'version':129C 'vulner':8A 'whether':55B 'whole':84C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-08-01T14:15:13+00:00","kev":{"dateAdded":"2021-12-10","dueDate":"2022-06-10","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-0193","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-0193","severity":null,"published_at":"2021-12-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2019-0193","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0193","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-0193","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0193","severity":null,"published_at":"2019-08-01T14:15:13+00:00","modified_at":"2026-06-17T02:07:55+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}