Live › vulnerability › CVE-2019-17558
Go to dashboardApache Solr's VelocityResponseWriter plug-in has a flaw that allows remote code execution on the server. An attacker can run commands on a Solr host without logging in, and CISA lists it as actively exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Apache Solr | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting params.resource.loader.enabled by defining a response writer with that setting set to true. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is trusted (has been uploaded by an authenticated user).
This page as .md · .json · in your agent: get_signal("CVE-2019-17558")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.