{"id":"CVE-2019-17558","kind":"vulnerability","aliases":["CVE-2019-17558"],"related":[],"title":"Apache Solr: Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability","description":"Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).","summary":"Apache Solr's VelocityResponseWriter plug-in has a flaw that allows remote code execution on the server. An attacker can run commands on a Solr host without logging in, and CISA lists it as actively exploited.","severity":"critical","cvss":7.5,"epss":0.98567,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Apache Solr","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","java","package","self-hosted","solr"],"not_affected_if":["no-solr-deployed","velocity-writer-disabled"],"how_to_check":null,"fix":"Apply the vendor update per Apache Solr instructions; the affected and fixed versions are not stated in the sources.\nIf you cannot patch, check the Solr configuration for the VelocityResponseWriter (velocity) response writer and disable it if unused.","status":"open","published_at":"2019-12-30T17:15:19+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:37:09+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:37:09Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per Apache Solr instructions; the affected and fixed versions are not stated in the sources.\nIf you cannot patch, check the Solr configuration for the VelocityResponseWriter (velocity) response writer and disable it if unused.","reach":"internet","impact":"high","summary":"Apache Solr's VelocityResponseWriter plug-in has a flaw that allows remote code execution on the server. An attacker can run commands on a Solr host without logging in, and CISA lists it as actively exploited.","category":"package","who_cares":["solr","self-hosted","java"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the Solr server remotely.","analyst_note":"Find the affected and fixed Solr versions and the exact default state of the velocity response writer at https://solr.apache.org/security.html and the NVD entry for CVE-2019-17558.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-solr-deployed","velocity-writer-disabled"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000486,"input_tokens":2831,"output_tokens":406,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the affected and fixed Solr versions and the exact default state of the velocity response writer at https://solr.apache.org/security.html and the NVD entry for CVE-2019-17558.","search":"'-17558':15A,18A '-2019':14A,17A '5.0.0':67C '8.3.1':71C '8.4':144C 'access':142C 'activ':63B 'allow':39B 'apach':1A,3A,28B,65C,69C 'apache':19A 'api':141C 'attack':47B 'authent':170C 'cisa':59B 'code':10A,41B,77C 'command':50B 'configset':93C,103C,156C,162C 'configset-provid':155C 'configur':140C 'contain':105C 'could':104C 'cve':13A,16A 'default':116C 'defin':102C,125C,135C 'directori':95C 'disabl':114C 'enabl':120C,153C 'entir':150C 'execut':11A,42B,78C 'exploit':21B,64B 'flaw':37B 'host':26B,54B 'java':22B 'list':60B 'loader':149C 'log':56B 'malici':108C 'packag':23B 'param':147C 'paramet':99C,110C 'params.resource.loader.enabled':123C 'plug':7A,33B 'plug-in':6A,32B 'potenti':107C 'provid':87C,111C,157C 'remot':9A,40B,76C 'remov':145C 'render':106C,159C 'requir':139C 'resourc':148C 'respons':127C,137C 'run':49B 'self':25B 'self-host':24B 'server':45B 'set':122C,131C,132C 'solr':2A,4A,20A,27B,29B,53B,66C,70C,143C 'templat':84C,90C,109C,112C,158C 'true':134C 'trust':164C 'upload':167C 'user':101C,171C 'veloc':83C,89C,94C 'velocityresponsewrit':5A,31B,81C 'vulner':12A,73C 'without':55B 'writer':128C,138C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-12-30T17:15:19+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-17558","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-17558","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T11:39:17+00:00","note":null},{"source":"epss","external_id":"CVE-2019-17558","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-17558","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-17558","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17558","severity":null,"published_at":"2019-12-30T17:15:19+00:00","modified_at":"2026-06-17T02:24:09+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}