CVE-2019-0193
XML External Entity (XXE) Injection in Apache Solr
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
- Record
CVE-2019-0193- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
- Record
CVE-2019-0193- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2019-0615
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
- Record
EUVD-2019-0615- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3gm7-v7vw-866c
XML External Entity (XXE) Injection in Apache Solr
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
- Record
GHSA-3gm7-v7vw-866c- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H - Weakness
- CWE-94
- Updated
- 2026-11-02
CISA KEV No score
Apache Solr DataImportHandler Code Injection Vulnerability
The optional Apache Solr module DataImportHandler contains a code injection vulnerability.
- Record
CVE-2019-0193- Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
- Record
CVE-2019-0193- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2019-0193
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
- Record
DEBIAN-CVE-2019-0193- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-3gm7-v7vw-866c
XML External Entity (XXE) Injection in Apache Solr
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
- Record
GHSA-3gm7-v7vw-866c- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-0193
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
- Record
UBUNTU-CVE-2019-0193- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.2 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1790616173 No score
TuxCare security update for org.apache.solr:solr-core (4 CVEs)
TuxCare rebuilt org.apache.solr:solr-core to address 4 CVEs. Fixed in 5.5.5-tuxcare.3.
- Record
CLSA-2026-1790616173- Updated
- 2026-11-02
OSVUSN-7283-1 No score
lucene-solr vulnerability
It was discovered that the Apache Solr DataImportHandler module incorrectly handled certain request parameters in a default configuration. A remote attacker could possibly use this issue to execute arbitrary code.
- Record
USN-7283-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.solr:solr-coreMaven |
before 8.2.0 | 8.2.0 |
org.apache.solr:solr-coreTuxCare:Maven From an advisory covering 4 CVEs |
5.5.5 up to 5.5.5-tuxcare.3, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.2 |
5.5.5-tuxcare.3 |
lucene-solrDebian:12 |
before 3.6.2+dfsg-22 | 3.6.2+dfsg-22 |
lucene-solrDebian:13 |
before 3.6.2+dfsg-22 | 3.6.2+dfsg-22 |
lucene-solrDebian:14 |
before 3.6.2+dfsg-22 | 3.6.2+dfsg-22 |
lucene-solrDebian:8 |
before 3.6.2+dfsg-5+deb8u3, plus listed versions 3.6.2+dfsg-53.6.2+dfsg-5+deb8u13.6.2+dfsg-5+deb8u2 |
3.6.2+dfsg-5+deb8u3 |
lucene-solrDebian:9 |
before 3.6.2+dfsg-10+deb9u3, plus listed versions 3.6.2+dfsg-103.6.2+dfsg-10+deb9u13.6.2+dfsg-10+deb9u2 |
3.6.2+dfsg-10+deb9u3 |
org.apache.solr:solr-coreMaven |
before 8.2.0, plus listed versions 1.3.01.4.01.4.13.1.03.2.0 Show 45 moreShow less3.3.03.4.03.5.03.6.03.6.13.6.24.0.04.0.0-ALPHA4.0.0-BETA4.1.04.10.04.10.14.10.24.10.34.10.44.2.04.2.14.3.04.3.14.4.04.5.04.5.14.6.04.6.14.7.04.7.14.7.24.8.04.8.14.9.04.9.15.0.05.1.05.2.05.2.15.3.05.3.15.3.25.4.05.4.15.5.05.5.15.5.25.5.35.5.4 |
8.2.0 |
lucene-solrUbuntu:Pro:14.04:LTS |
before 3.6.2+dfsg-2ubuntu0.1~esm4, plus listed versions 3.6.2+dfsg-13.6.2+dfsg-23.6.2+dfsg-2ubuntu0.1~esm13.6.2+dfsg-2ubuntu0.1~esm2 |
3.6.2+dfsg-2ubuntu0.1~esm4 |
lucene-solrUbuntu:Pro:16.04:LTS |
before 3.6.2+dfsg-8ubuntu0.1+esm1, plus listed versions 3.6.2+dfsg-73.6.2+dfsg-83.6.2+dfsg-8ubuntu0.1 |
3.6.2+dfsg-8ubuntu0.1+esm1 |
lucene-solrUbuntu:Pro:18.04:LTS |
before 3.6.2+dfsg-18~18.04.1~esm2, plus listed versions 3.6.2+dfsg-103.6.2+dfsg-113.6.2+dfsg-18~18.04 |
3.6.2+dfsg-18~18.04.1~esm2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | xConsoIe/CVE-2019-0193 | 2019-03-18 |
| PoC in GitHub | jas502n/CVE-2019-0193 | 2019-08-09 |
| PoC in GitHub | 1135/solr_exploit | 2019-08-12 |
| PoC in GitHub | jaychouzzk/CVE-2019-0193-exp | 2019-09-03 |
| PoC in GitHub | freeFV/ApacheSolrRCE | 2022-09-13 |
| Nuclei | Apache Solr DataImportHandler <8.2.0 - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-0193 is a high vulnerability (CVSS 7.2) in Apache Solr, published August 1, 2019. CISA lists it as known to be exploited, since December 10, 2021. EUVD reports exploitation since December 10, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 83.5%, the 99th percentile. Fixed in org.apache.solr:solr-core 8.2.0.
References
issues.apache.org/jira/browse/SOLR-13669
lists.debian.org/debian-lts-announce/2019/10/msg00013.html
lists.apache.org/thread.html/7143983363f0ba463475be4a8b775077070a08dbf075449b7beb51ee%40%3Cissues.lucene.apache.org%3E
Show 46 moreShow less
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0193
nvd.nist.gov/vuln/detail/CVE-2019-0193
github.com/apache/lucene-solr/commit/02c693f3713add1b4891cbaa87127de3a55c10f7
snyk.io/vuln/SNYK-JAVA-ORGAPACHESOLR-536063
security-tracker.debian.org/tracker/CVE-2019-0193
ubuntu.com/security/CVE-2019-0193
cve.org/CVERecord?id=CVE-2019-0193
Left out here: 36 versions. The JSON record has them.