{"id":"CVE-2019-17558","aliases":["CLSA-2026-1790616173","DEBIAN-CVE-2019-17558","EUVD-2020-0320","GHSA-ww97-9w65-2crx"],"status":"published","title":"Improper Input Validation in Apache Solr","description":"Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.98567,"percentile":0.99922,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-20","CWE-74","CWE-94"],"published":"2019-12-30T16:36:08Z","modified":"2026-11-02T19:46:24Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"metasploit","id":"exploit/multi/http/solr_velocity_rce","title":"Apache Solr Remote Code Execution via Velocity Template","type":"exploit","platform":"Java,Linux,Unix,Windows","date":"2019-10-29","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/solr_velocity_rce"},{"source":"exploitdb","id":"EDB-47572","title":"Apache Solr 8.2.0 - Remote Code Execution","type":"webapps","platform":"java","date":"2019-11-01","url":"https://www.exploit-db.com/exploits/47572"},{"source":"pocgithub","id":"thelostworldFree/CVE-2019-17558_Solr_Vul_Tool","title":"thelostworldFree/CVE-2019-17558_Solr_Vul_Tool","date":"2020-03-27","url":"https://github.com/thelostworldFree/CVE-2019-17558_Solr_Vul_Tool"},{"source":"pocgithub","id":"zhzyker/exphub","title":"zhzyker/exphub","date":"2020-04-01","url":"https://github.com/zhzyker/exphub"},{"source":"exploitdb","id":"EDB-48338","title":"Apache Solr - Remote Code Execution via Velocity Template (Metasploit)","type":"remote","platform":"multiple","date":"2020-04-16","verified":true,"url":"https://www.exploit-db.com/exploits/48338"},{"source":"pocgithub","id":"Ma1Dong/Solr_CVE-2019-17558","title":"Ma1Dong/Solr_CVE-2019-17558","date":"2020-08-04","url":"https://github.com/Ma1Dong/Solr_CVE-2019-17558"},{"source":"pocgithub","id":"xkyrage/Exploit_CVE-2019-17558-RCE","title":"xkyrage/Exploit_CVE-2019-17558-RCE","date":"2020-12-15","url":"https://github.com/xkyrage/Exploit_CVE-2019-17558-RCE"},{"source":"pocgithub","id":"rogerzeferino/cve-2019-17558-apache-solr-rce","title":"rogerzeferino/cve-2019-17558-apache-solr-rce","date":"2026-02-16","url":"https://github.com/rogerzeferino/cve-2019-17558-apache-solr-rce"},{"source":"pocgithub","id":"CyberCTF/vulhub-solr-cve-2019-17558","title":"CyberCTF/vulhub-solr-cve-2019-17558","date":"2026-10-08","url":"https://github.com/CyberCTF/vulhub-solr-cve-2019-17558"},{"source":"nuclei","id":"CVE-2019-17558","title":"Apache Solr \u003c=8.3.1 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17558.yaml"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.solr:solr-core","fixed_in":["8.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.solr:solr-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"last_affected":"5.5.5"},{"fixed":"8.4.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.solr:solr-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"last_affected":"6.6.6"},{"fixed":"8.4.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.solr:solr-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.7.2"},{"fixed":"8.4.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.solr:solr-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"last_affected":"8.3.1"},{"fixed":"8.4.0"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.5"},{"fixed":"5.5.5-tuxcare.3"}]}],"versions":["5.5.5","5.5.5-tuxcare.1","5.5.5-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"lucene-solr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2+dfsg-26","3.6.2+dfsg-27"]},{"source":"osv","ecosystem":"Debian:13","package":"lucene-solr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2+dfsg-26","3.6.2+dfsg-27"]},{"source":"osv","ecosystem":"Debian:14","package":"lucene-solr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2+dfsg-26","3.6.2+dfsg-27"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.solr:solr-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"8.4.0"}]}],"versions":["5.0.0","5.1.0","5.2.0","5.2.1","5.3.0","5.3.1","5.3.2","5.4.0","5.4.1","5.5.0","5.5.1","5.5.2","5.5.3","5.5.4","5.5.5","6.0.0","6.0.1","6.1.0","6.2.0","6.2.1","6.3.0","6.4.0","6.4.1","6.4.2","6.5.0","6.5.1","6.6.0","6.6.1","6.6.2","6.6.3","6.6.4","6.6.5","6.6.6","7.0.0","7.0.1","7.1.0","7.2.0","7.2.1","7.3.0","7.3.1","7.4.0","7.5.0","7.6.0","7.7.0","7.7.1","7.7.2","7.7.3","8.0.0","8.1.0","8.1.1","8.2.0","8.3.0","8.3.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.solr:solr-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"8.4.0"}]}],"versions":["6.0.0","6.0.1","6.1.0","6.2.0","6.2.1","6.3.0","6.4.0","6.4.1","6.4.2","6.5.0","6.5.1","6.6.0","6.6.1","6.6.2","6.6.3","6.6.4","6.6.5","6.6.6","7.0.0","7.0.1","7.1.0","7.2.0","7.2.1","7.3.0","7.3.1","7.4.0","7.5.0","7.6.0","7.7.0","7.7.1","7.7.2","7.7.3","8.0.0","8.1.0","8.1.1","8.2.0","8.3.0","8.3.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.solr:solr-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.4.0"}]}],"versions":["7.0.0","7.0.1","7.1.0","7.2.0","7.2.1","7.3.0","7.3.1","7.4.0","7.5.0","7.6.0","7.7.0","7.7.1","7.7.2","7.7.3","8.0.0","8.1.0","8.1.1","8.2.0","8.3.0","8.3.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.solr:solr-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.4.0"}]}],"versions":["8.0.0","8.1.0","8.1.1","8.2.0","8.3.0","8.3.1"]}],"products":[{"vendor":"apache","product":"solr"},{"vendor":"apache software foundation","product":"apache solr"},{"vendor":"oracle","product":"primavera_unifier"}],"references":[{"url":"https://lists.apache.org/thread.html/rb964fe5c4e3fc05f75e8f74bf6b885f456b7a7750c36e9a8045c627a%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/r9271d030452170ba6160c022757e1b5af8a4c9ccf9e04164dec02e7f%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/ra29fa6ede5184385bf2c63e8ec054990a7d4622bba1d244bee70d82d%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/r36e35fd76239a381643555966fb3e72139e018d52d76544fb42f96d8%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Issue Tracking","Mailing List","report","web"]},{"url":"https://lists.apache.org/thread.html/r5074d814d3a8c75df4b20e66bfd268ee0a73ddea7e85070cec3ae78d%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","evidence","web"]},{"url":"https://lists.apache.org/thread.html/rf6d7ffae2b940114324e036b6394beadf27696d051ae0c4a5edf07af%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","evidence","web"]},{"url":"https://lists.apache.org/thread.html/r58c58fe51c87bc30ee13bb8b4c83587f023edb349018705208e65b37%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/r25f1bd4545617f5b86dde27b4c30fec73117af65598a30e20209739a%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/r12ab2cb15a34e49b4fecb5b2bdd7e10f3e8b7bf1f4f47fcde34d3a7c%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/r99c3f7ec3a079e2abbd540ecdb55a0e2a0f349ca7084273a12e87aeb%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/r0b7b9d4113e6ec1ae1d3d0898c645f758511107ea44f0f3a1210c5d5%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/r339865b276614661770c909be1dd7e862232e3ef0af98bfd85686b51%40%3Cdev.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Issue Tracking","Mailing List","report","web"]},{"url":"https://lists.apache.org/thread.html/r19d23e8640236a3058b4d6c23e5cd663fde182255f5a9d63e0606a66%40%3Cdev.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/rafc939fdd753f55707841cd5886fc7fcad4d8d8ba0c72429b3220a9a%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/rde3dbd8e646dabf8bef1b097e9a13ee0ecbdb8441aaed6092726c98d%40%3Cissues.ambari.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/rf5230a049d989dbfdd404b4320a265dceeeba459a4d04ec21873bd55%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://issues.apache.org/jira/browse/SOLR-13971","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Vendor Advisory","fix","web"]},{"url":"http://packetstormsecurity.com/files/157078/Apache-Solr-8.3.0-Velocity-Template-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"https://lists.apache.org/thread.html/rc400db37710ee79378b6c52de3640493ff538c2beb41cefdbbdf2ab8%40%3Ccommits.submarine.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/r79c7e75f90e735fd32c4e3e97340625aab66c09dfe8c4dc0ab768b69%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/re8d12db916b5582a23ed144b9c5abd0bea0be1649231aa880f6cbfff%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/r8a36e4f92f4449dec517e560e1b55639f31b3aca26c37bbad45e31de%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/r7b89b3dcfc1b6c52dd8d610b897ac98408245040c92b484fe97a51a2%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/r8e7a3c253a695a7667da0b0ec57f9bb0e31f039e62afbc00a1d96f7b%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/r5dc200f7337093285bac40e6d5de5ea66597c3da343a0f7553f1bb12%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/r7f21ab40a9b17b1a703db84ac56773fcabacd4cc1eb5c4700d17c071%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-17558","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17558","tags":["advisory"]},{"url":"https://github.com/apache/lucene-solr/pull/1156","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/SOLR-14025","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r0b7b9d4113e6ec1ae1d3d0898c645f758511107ea44f0f3a1210c5d5@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r12ab2cb15a34e49b4fecb5b2bdd7e10f3e8b7bf1f4f47fcde34d3a7c@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r25f1bd4545617f5b86dde27b4c30fec73117af65598a30e20209739a@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r36e35fd76239a381643555966fb3e72139e018d52d76544fb42f96d8@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r5074d814d3a8c75df4b20e66bfd268ee0a73ddea7e85070cec3ae78d@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r58c58fe51c87bc30ee13bb8b4c83587f023edb349018705208e65b37@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r9271d030452170ba6160c022757e1b5af8a4c9ccf9e04164dec02e7f@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r99c3f7ec3a079e2abbd540ecdb55a0e2a0f349ca7084273a12e87aeb@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/ra29fa6ede5184385bf2c63e8ec054990a7d4622bba1d244bee70d82d@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rb964fe5c4e3fc05f75e8f74bf6b885f456b7a7750c36e9a8045c627a@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rf6d7ffae2b940114324e036b6394beadf27696d051ae0c4a5edf07af@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r19d23e8640236a3058b4d6c23e5cd663fde182255f5a9d63e0606a66@%3Cdev.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r339865b276614661770c909be1dd7e862232e3ef0af98bfd85686b51@%3Cdev.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rafc939fdd753f55707841cd5886fc7fcad4d8d8ba0c72429b3220a9a@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rde3dbd8e646dabf8bef1b097e9a13ee0ecbdb8441aaed6092726c98d@%3Cissues.ambari.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rc400db37710ee79378b6c52de3640493ff538c2beb41cefdbbdf2ab8@%3Ccommits.submarine.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rf5230a049d989dbfdd404b4320a265dceeeba459a4d04ec21873bd55@%3Csolr-user.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r5dc200f7337093285bac40e6d5de5ea66597c3da343a0f7553f1bb12@%3Csolr-user.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r79c7e75f90e735fd32c4e3e97340625aab66c09dfe8c4dc0ab768b69@%3Csolr-user.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r7b89b3dcfc1b6c52dd8d610b897ac98408245040c92b484fe97a51a2@%3Csolr-user.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r8a36e4f92f4449dec517e560e1b55639f31b3aca26c37bbad45e31de@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r8e7a3c253a695a7667da0b0ec57f9bb0e31f039e62afbc00a1d96f7b@%3Csolr-user.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/re8d12db916b5582a23ed144b9c5abd0bea0be1649231aa880f6cbfff@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r7f21ab40a9b17b1a703db84ac56773fcabacd4cc1eb5c4700d17c071@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1@%3Ccommits.druid.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-ww97-9w65-2crx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-17558","tags":["advisory"]},{"url":"https://github.com/apache/lucene-solr","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2019-17558","description":"Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).","status":"published","published":"2019-12-30T16:36:08Z","modified":"2025-10-21T23:35:54.15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2020-0320","description":"Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).","status":"published","published":"2019-12-30T16:36:08Z","modified":"2025-10-21T23:35:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T20:31:24.816637Z"}],"ghsa":[{"id":"GHSA-ww97-9w65-2crx","title":"Improper Input Validation in Apache Solr","description":"Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).","status":"published","published":"2020-02-12T18:45:28Z","modified":"2025-10-22T17:45:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H","level":"high"}],"cwes":["CWE-20","CWE-74","CWE-94"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2019-17558","title":"Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability","description":"The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution.","cwes":["CWE-74"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2019-17558","description":"Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).","status":"published","published":"2019-12-30T17:15:19.78Z","modified":"2026-06-17T02:24:09.007Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":4.6,"vector":"AV:N/AC:H/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:05:41.313583Z"}],"osv":[{"id":"CVE-2019-17558","description":"Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).","status":"published","published":"2019-12-30T17:15:19.78Z","modified":"2026-10-24T14:19:57.589649166Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-17558","description":"Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).","status":"published","published":"2019-12-30T17:15:19.78Z","modified":"2026-09-21T07:03:07.622049255Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"GHSA-ww97-9w65-2crx","title":"Improper Input Validation in Apache Solr","description":"Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).","status":"published","published":"2020-02-12T18:45:28Z","modified":"2025-10-22T19:19:11.042114Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H","level":"high"}],"cwes":["CWE-20","CWE-74","CWE-94"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"CLSA-2026-1790616173","title":"TuxCare security update for org.apache.solr:solr-core (4 CVEs)","description":"TuxCare rebuilt org.apache.solr:solr-core to address 4 CVEs. Fixed in 5.5.5-tuxcare.3.","status":"published","published":"2026-09-28T17:22:53Z","modified":"2026-11-02T19:46:24.62261823Z","updated_at":"2026-11-02T20:29:22.637147Z"}]}}