en Se connecter

7.2 Élevée Exploitée

CVE-2019-0193 Apache Solr DataImportHandler Code Injection Vulnerability

Exploitation active constatée

· catalogue CISA KEV

Action attendue Apply updates per vendor instructions.

Campagnes de rançongiciel Non constatée à ce jour

Faiblesse CWE-94

Description

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
Apache Solr	Versions non publiées

Références

issues.apache.org issues.apache.org
[debian-lts-announce] 20191010 [SECURITY] [DLA 1954-1] lucene-solr security update lists.debian.org
[lucene-issues] 20191025 [jira] [Updated] (SOLR-13873) Is there any fix for CVE-2019-0193 issue for solr 7.7.1 lists.apache.org
[lucene-issues] 20191025 [jira] [Created] (SOLR-13873) Is there any fix for CVE-2019-0193 issue for solr 7.7.1 lists.apache.org
[lucene-issues] 20191025 [jira] [Resolved] (SOLR-13873) Is there any fix for CVE-2019-0193 issue for solr 7.7.1 lists.apache.org
[lucene-issues] 20191025 [jira] [Commented] (SOLR-13669) [CVE-2019-0193] Remote Code Execution via DataImportHandler lists.apache.org
[lucene-issues] 20191025 [jira] [Commented] (SOLR-13873) Is there any fix for CVE-2019-0193 issue for solr 7.7.1 lists.apache.org
[nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html lists.apache.org
[lucene-issues] 20191129 [jira] [Commented] (SOLR-13669) [CVE-2019-0193] Remote Code Execution via DataImportHandler lists.apache.org
[lucene-issues] 20191130 [jira] [Resolved] (SOLR-13669) [CVE-2019-0193] Remote Code Execution via DataImportHandler lists.apache.org
[lucene-issues] 20191130 [jira] [Closed] (SOLR-13669) [CVE-2019-0193] Remote Code Execution via DataImportHandler lists.apache.org
[nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html lists.apache.org
[lucene-dev] 20200213 Re: 7.7.3 bugfix release lists.apache.org
[lucene-dev] 20200214 Re: 7.7.3 bugfix release lists.apache.org
[lucene-issues] 20200218 [jira] [Updated] (SOLR-13669) [CVE-2019-0193] Remote Code Execution via DataImportHandler lists.apache.org
[lucene-issues] 20200218 [jira] [Commented] (SOLR-13669) [CVE-2019-0193] Remote Code Execution via DataImportHandler lists.apache.org
[debian-lts-announce] 20200816 [SECURITY] [DLA 2327-1] lucene-solr security update lists.debian.org
[submarine-commits] 20201209 [GitHub] [submarine] QiAnXinCodeSafe opened a new issue #474: There is a vulnerability in Apache Solr 5.5.4,upgrade recommended lists.apache.org
[druid-commits] 20210324 [GitHub] [druid] jihoonson opened a new pull request #11030: Suppress cves lists.apache.org
[solr-users] 20210618 CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability lists.apache.org
[solr-users] 20210618 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability lists.apache.org
[solr-users] 20210728 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability lists.apache.org

Chronologie

Publiée 1 août 2019
Ajoutée au catalogue KEV 10 décembre 2021
Dernière modification 21 octobre 2025

Les 2 CVE de Apache Solr →

CVE-2018-11802 In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any… Non notée

Suivre cette CVE