CVE-2019-0193
KEVHIGH 9.0EPSS 83.5%
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
- CVSS v3.1
- 7.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1
- 7.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1
- 7.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H - CVSS v2.0
- 9.0 HIGH
AV:N/AC:L/Au:S/C:C/I:C/A:C - EPSS
- 83.55% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2021-12-10
- Nuclei
- high · CWE-94
- Published
- 2019-08-01
- Updated
- 2025-10-21
Proof-of-concept exploits (6)
- 1135/solr_exploit65★ · 2020-07-08
- freeFV/ApacheSolrRCE0★ · 2022-09-13
- jas502n/CVE-2019-019390★ · 2019-08-12
- jaychouzzk/CVE-2019-0193-exp1★ · 2019-09-04
- scxiaotan1/Docker0★ · 2023-03-21
- xConsoIe/CVE-2019-01937★ · 2019-03-18
Nuclei templates (1)
Vulhub environments (1)
Exploit collections (3)
- chaitin/xray/blob/master/pocs/solr-cve-2019-0193.yml
- helloexp/0day/tree/master/96-Java%E4%B8%93%E5%8C%BA/25-Solr/Solr%20%E8%BF%9C%E7%A8%8B%E5%…
- zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2019/CVE-2019-0193.yaml