CVE-2019-17558
Improper Input Validation in Apache Solr
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting params.resource.loader.enabled by defining a response writer with that setting set to true. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is trusted (has been uploaded by an authenticated user).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting params.resource.loader.enabled by defining a response writer with that setting set to true. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is trusted (has been uploaded by an authenticated user).
- Record
CVE-2019-17558- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:N/AC:H/Au:S/C:P/I:P/A:P - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE List
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting params.resource.loader.enabled by defining a response writer with that setting set to true. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is trusted (has been uploaded by an authenticated user).
- Record
CVE-2019-17558- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
EUVDEUVD-2020-0320
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting params.resource.loader.enabled by defining a response writer with that setting set to true. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is trusted (has been uploaded by an authenticated user).
- Record
EUVD-2020-0320- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-ww97-9w65-2crx
Improper Input Validation in Apache Solr
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting params.resource.loader.enabled by defining a response writer with that setting set to true. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is trusted (has been uploaded by an authenticated user).
- Record
GHSA-ww97-9w65-2crx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H - Weakness
- CWE-20, CWE-74, CWE-94
- Updated
- 2026-11-02
CISA KEV No score
Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability
The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution.
- Record
CVE-2019-17558- Weakness
- CWE-74
- Updated
- 2026-11-02
OSV
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting params.resource.loader.enabled by defining a response writer with that setting set to true. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is trusted (has been uploaded by an authenticated user).
- Record
CVE-2019-17558- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-17558
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting params.resource.loader.enabled by defining a response writer with that setting set to true. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is trusted (has been uploaded by an authenticated user).
- Record
DEBIAN-CVE-2019-17558- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-ww97-9w65-2crx
Improper Input Validation in Apache Solr
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting params.resource.loader.enabled by defining a response writer with that setting set to true. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is trusted (has been uploaded by an authenticated user).
- Record
GHSA-ww97-9w65-2crx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H - Weakness
- CWE-20, CWE-74, CWE-94
- Updated
- 2026-11-02
OSVCLSA-2026-1790616173 No score
TuxCare security update for org.apache.solr:solr-core (4 CVEs)
TuxCare rebuilt org.apache.solr:solr-core to address 4 CVEs. Fixed in 5.5.5-tuxcare.3.
- Record
CLSA-2026-1790616173- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.solr:solr-coreMaven |
5.0.0 to 5.5.5 | 8.4.0 |
org.apache.solr:solr-coreMaven |
6.0.0 to 6.6.6 | 8.4.0 |
org.apache.solr:solr-coreMaven |
7.0.0 to 7.7.2 | 8.4.0 |
org.apache.solr:solr-coreMaven |
8.0.0 to 8.3.1 | 8.4.0 |
org.apache.solr:solr-coreTuxCare:Maven From an advisory covering 4 CVEs |
5.5.5 up to 5.5.5-tuxcare.3, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.2 |
5.5.5-tuxcare.3 |
lucene-solrDebian:12 |
All versions, plus listed versions 3.6.2+dfsg-263.6.2+dfsg-27 |
None known |
lucene-solrDebian:13 |
All versions, plus listed versions 3.6.2+dfsg-263.6.2+dfsg-27 |
None known |
lucene-solrDebian:14 |
All versions, plus listed versions 3.6.2+dfsg-263.6.2+dfsg-27 |
None known |
org.apache.solr:solr-coreMaven |
5.0.0 up to 8.4.0, plus listed versions 5.1.05.2.05.2.15.3.05.3.1 Show 45 moreShow less5.3.25.4.05.4.15.5.05.5.15.5.25.5.35.5.45.5.56.0.06.0.16.1.06.2.06.2.16.3.06.4.06.4.16.4.26.5.06.5.16.6.06.6.16.6.26.6.36.6.46.6.56.6.67.0.07.0.17.1.07.2.07.2.17.3.07.3.17.4.07.5.07.6.07.7.07.7.17.7.27.7.38.0.08.1.08.1.18.2.0 |
8.4.0 |
org.apache.solr:solr-coreMaven |
6.0.0 up to 8.4.0, plus listed versions 6.0.16.1.06.2.06.2.16.3.0 Show 32 moreShow less6.4.06.4.16.4.26.5.06.5.16.6.06.6.16.6.26.6.36.6.46.6.56.6.67.0.07.0.17.1.07.2.07.2.17.3.07.3.17.4.07.5.07.6.07.7.07.7.17.7.27.7.38.0.08.1.08.1.18.2.08.3.08.3.1 |
8.4.0 |
org.apache.solr:solr-coreMaven |
7.0.0 up to 8.4.0, plus listed versions 7.0.17.1.07.2.07.2.17.3.0 Show 14 moreShow less7.3.17.4.07.5.07.6.07.7.07.7.17.7.27.7.38.0.08.1.08.1.18.2.08.3.08.3.1 |
8.4.0 |
org.apache.solr:solr-coreMaven |
8.0.0 up to 8.4.0, plus listed versions 8.1.08.1.18.2.08.3.08.3.1 |
8.4.0 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Apache Solr Remote Code Execution via Velocity Template | 2019-10-29 |
| Exploit-DB | Apache Solr 8.2.0 - Remote Code Execution | 2019-11-01 |
| PoC in GitHub | thelostworldFree/CVE-2019-17558_Solr_Vul_Tool | 2020-03-27 |
| PoC in GitHub | zhzyker/exphub | 2020-04-01 |
| Exploit-DB | Apache Solr - Remote Code Execution via Velocity Template (Metasploit) | 2020-04-16 |
| PoC in GitHub | Ma1Dong/Solr_CVE-2019-17558 | 2020-08-04 |
| PoC in GitHub | xkyrage/Exploit_CVE-2019-17558-RCE | 2020-12-15 |
| PoC in GitHub | rogerzeferino/cve-2019-17558-apache-solr-rce | 2026-02-16 |
| PoC in GitHub | CyberCTF/vulhub-solr-cve-2019-17558 | 2026-10-08 |
| Nuclei | Apache Solr <=8.3.1 - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-17558 is a high vulnerability (CVSS 7.5) in Apache Solr, published December 30, 2019. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 98.6%, the 99th percentile. Fixed in org.apache.solr:solr-core 8.4.0.
References
lists.apache.org/thread.html/rb964fe5c4e3fc05f75e8f74bf6b885f456b7a7750c36e9a8045c627a%40%3Cissues.lucene.apache.org%3E
Show 56 moreShow less
oracle.com/security-alerts/cpuoct2020.html
issues.apache.org/jira/browse/SOLR-13971
packetstormsecurity.com/files/157078/Apache-Solr-8.3.0-Velocity-Template-Remote-Code-Execution.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-17558
nvd.nist.gov/vuln/detail/CVE-2019-17558
github.com/apache/lucene-solr/pull/1156
security-tracker.debian.org/tracker/CVE-2019-17558
Left out here: 2 versions. The JSON record has them.