CVE-2019-0193 - Apache Solr
AI Vulnerability ContextIn Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting wi...
Overview
A source-backed snapshot of this vulnerability.
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
Vulnerability status
How serious this vulnerability is and whether it is known to be exploited.
- CVE ID
- CVE-2019-0193
- Vendor/project
- Apache
- Product
- Solr
- Vulnerability name
- Apache Solr DataImportHandler Code Injection Vulnerability
- Date added
- 2021-12-10
- Due date
- 2022-06-10
- Known ransomware campaign use
- Unknown
- CVSS v3
- 7.2
Exploit context
What the vulnerability is about.
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
Source evidence
Original public records and references for this page.
Original source
Original source links
Open the public records and source datasets used for this page.