CVE-2019-0193

HIGH(7.2)KEVLikely Exploited

Apache Solr DataImportHandler Code Injection Vulnerability

Description

CVE-2019-0193 is a high-severity code injection vulnerability in the Apache Solr DataImportHandler module that allows authenticated attackers to execute arbitrary code on the server. The DataImportHandler (DIH) is an optional but widely used Solr module that pulls data from external sources, and its debug mode accepts a 'dataConfig' parameter that can contain executable scripts. An attacker with access to the DIH admin screen can inject malicious code through this parameter to achieve remote code execution. This Apache Solr vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog. With an EPSS score of 93.20% (99.8th percentile), CVE-2019-0193 has a near-certain probability of exploitation.

KEV Information

Vendor
Apache
Product
Solr
Date Added
December 10, 2021
Due Date
June 10, 2022
Required Action
Apply updates per vendor instructions.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.2
Impact Score
5.9

CWEs

CWE-94Code Injection

Improper Control of Generation of Code

Affected Products

VendorProductVersion
apachesolr< 7.7.3; >= 8.1.0, < 8.1.2
debiandebian linux8.0; 9.0

Multiple CVSS Assessments

Source: [email protected](Primary)
7.2
HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)
7.2
HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Weakness Type

CWE-94: Code Injection

Code Injection occurs when software constructs code segments using externally-influenced input without properly neutralizing special elements that could modify the intended code behavior. In Apache Solr's DataImportHandler, the 'dataConfig' parameter accepts a complete DIH configuration from the request, and since DIH configurations can contain scripts, this parameter becomes a vector for injecting and executing arbitrary code within the Solr server's context.

Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')

Impact Analysis

CVE-2019-0193 carries a CVSS 3.1 score of 7.2 (HIGH), indicating a serious threat to affected Apache Solr deployments. The vulnerability is remotely exploitable over the network with low attack complexity, though it requires high-level privileges (administrative access to the DIH admin screen) and no user interaction. Successful exploitation fully compromises confidentiality, integrity, and availability of the Solr server, allowing attackers to read indexed data and server files, modify or delete search indices, and execute arbitrary commands on the underlying operating system. The EPSS score of 93.20% indicates near-certain exploitation probability. While the high privilege requirement limits the initial attack surface, misconfigured Solr instances with exposed admin interfaces or those accessible after an initial compromise significantly increase the exploitability of this vulnerability.

Exploit Maturity

CVE-2019-0193 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-06-10. The EPSS score of 93.20% (99.8th percentile) indicates near-certain exploitation probability, reflecting the widespread targeting of Apache Solr instances. The vulnerability is well-documented through the Apache Jira issue SOLR-13669, which provides detailed technical information about the DataImportHandler code injection mechanism. The availability of detailed vulnerability information and the prevalence of misconfigured Solr installations with exposed admin interfaces make this a high-priority target for attackers.

Remediation

  1. Upgrade Apache Solr to version 8.2.0 or later, which requires explicitly setting the Java System property enable.dih.dataConfigParam to true before the dataConfig parameter is accepted, effectively disabling the vulnerable feature by default.
  2. For environments running Solr versions prior to 8.2.0, update to Solr 7.7.3 or 8.1.2, which contain security fixes for this vulnerability. Verify affected products including Debian Linux 8.0 and 9.0 distributions that package Solr.
  3. Restrict access to the Solr admin interface using authentication and network-level controls. Ensure the DIH admin debug screen is not accessible from untrusted networks, and implement IP-based access restrictions for all administrative endpoints.
  4. If the DataImportHandler is not required, disable or remove the DIH module entirely from the Solr configuration. If DIH is needed, ensure that the enable.dih.dataConfigParam system property is not set to true in production environments.
  5. Monitor Solr logs for suspicious DataImportHandler requests, particularly those containing dataConfig parameters with embedded scripts, and implement web application firewall rules to detect and block code injection attempts targeting the DIH endpoint.

Technical Details

CVE-2019-0193 exploits a design flaw in Apache Solr's DataImportHandler module, where the debug mode of the DIH admin screen allows the entire DIH configuration to be supplied via the request's 'dataConfig' parameter. Since DIH configurations support embedded scripts (such as JavaScript or other scripting languages supported by the Java scripting engine), an attacker who can submit requests to the DIH endpoint can inject arbitrary code that executes within the Solr process context. The vulnerability is classified as CWE-94 (Code Injection) because the application dynamically interprets code from an externally-controlled parameter. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects that while the attack is network-based with low complexity, it requires high privileges, limiting initial exploitability to scenarios where the attacker has administrative access or the admin interface is unprotected.

Frequently Asked Questions

Is CVE-2019-0193 being actively exploited?

Yes. CVE-2019-0193 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation of the Apache Solr DataImportHandler vulnerability. The EPSS score of 93.20% (99.8th percentile) indicates near-certain exploitation probability.

What products are affected by CVE-2019-0193?

CVE-2019-0193 affects Apache Solr versions prior to 7.7.3 and versions 8.1.0 through 8.1.1 that have the DataImportHandler module enabled. Debian Linux 8.0 and 9.0 distributions packaging affected Solr versions are also impacted.

How do I fix CVE-2019-0193?

Upgrade Apache Solr to version 8.2.0 or later, which disables the vulnerable dataConfig parameter by default. Alternatively, update to version 7.7.3 or 8.1.2. Restrict access to the Solr admin interface and disable the DataImportHandler module if it is not required.

How severe is CVE-2019-0193?

CVE-2019-0193 has a CVSS 3.1 score of 7.2 (HIGH). While exploitation requires administrative privileges, the code injection vulnerability enables complete server compromise. The EPSS score of 93.20% (99.8th percentile) indicates very high exploitation probability, especially for Solr instances with exposed admin interfaces.

CVSS Score

7.2
HIGH(7.2)

EPSS Score

EPSS Score83.55%
EPSS Percentile99.7%

Dates

PublishedAugust 1, 2019
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch