CVE-2019-0193 Apache Solr
| Affected software | Apache Solr |
|---|---|
| Severity | 7.2 High CVSS 3.1 3 scores |
| Fixed in | 8.2.0 |
| Weakness | Code injection (CWE-94) |
| Published | 1 Aug 2019 |
| Updated | 29 Sep 2026 |
Description
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2021-12-10 · remediation due 2022-06-10 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 9 citations · honeypot sightings · 5 exploits · earliest 2020-01-16.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: total.
- Indexed PoC 6 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2019-03-18.
- EPSS 84% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.7% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2019-0193 in VulnCheck (free account), which lists 4 more citations not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | Shadowserver honeypots | Exploitation attempts seen on 170 days | 2023-12-06 to 2026-10-12 |
| Reported exploitation | alibabacloud.com | /blog/new-outbreak-of-h2miner-worms-exploiting-redis-rce-detected_595743 | 2020-01-16 |
| Reported exploitation | blogs.juniper.net | /en-us/threat-research/sysrv-botnet-expands-and-gains-persistence | 2021-04-08 |
| Reported exploitation | unit42.paloaltonetworks.com | /network-attack-trends-winter-2020 | 2021-04-12 |
| Reported exploitation | lacework.com | /blog/sysrv-hello-expands-infrastructure | 2021-04-22 |
| Reported exploitation | bleepingcomputer.com | /news/security/new-cryptomining-malware-builds-an-army-of-windows-linux-bots | 2021-04-24 |
| Exploit reference | VulnCheck XDB 0ff186cb197f | Exploit type: remote-with-credentials | 2019-08-09 |
| Exploit reference | VulnCheck XDB c6f3730bd8f0 | Exploit type: remote-with-credentials | 2019-08-12 |
| Exploit reference | VulnCheck XDB f9730ca2bcd0 | Exploit type: initial-access | 2019-09-03 |
| Exploit reference | VulnCheck XDB 9ca69682db00 | Exploit type: initial-access | 2020-05-14 |
| Exploit reference | VulnCheck XDB ccec007287ba | Exploit type: initial-access | 2022-09-13 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Apache Solr DataImport Handler RCE | 90 | 2019-08-09 |
| GitHub PoC | Apache Solr远程代码执行漏洞(CVE-2019-0193) Exploit | 64 | 2019-08-12 |
| GitHub PoC | xConsoIe/CVE-2019-0193 | 7 | 2019-03-18 |
| GitHub PoC | jaychouzzk/CVE-2019-0193-exp | 1 | 2019-09-03 |
| GitHub PoC | ApacheSolrRCE（CVE-2019-0193）一键写shell，原理是通过代码执行的java文件流写的马。 | 2022-09-13 | |
| Nuclei | Apache Solr DataImportHandler <8.2.0 - Remote Code Execution |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Process, Filesystem
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Process rule, ARMR Filesystem Write. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR Process rule, ARMR Filesystem Write
Solr DIH dataConfig script injection (CWE-94) through JSR-223 JavaScript. The Process rule (with /bin/* and /usr/* listed) blocks the Runtime.exec/ProcessBuilder PoCs; a filesystem write rule on the Solr webapp directory blocks the FileWriter JSP drop. A script that reads data directly in Java and returns it, without starting a program, is not stopped.
How to mitigate CVE-2019-0193
Upgrade Apache Solr to 8.2.0 or later. Until you can, Waratek RASP blocks exploitation with its process and filesystem rules. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
7.2 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
7.2 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.2 | HIGH | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 7.2 | HIGH | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 9.0 | none | AV:N/AC:L/Au:S/C:C/I:C/A:C |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.solr:solr-core |
0 | 8.2.0 |
unbounded |
Products and versions
3 products, 5 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | solr | generic | ＜ 7.7.3 · ≥ 8.1.0 and ＜ 8.1.2 |
| nvd | debian | debian linux | generic | 8.0 · 9.0 |
| osv | org.apache.solr | solr-core | generic | ＜ 8.2.0 |
References
Timeline
Timeline
| Published | 2019-08-01 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2020-01-16 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2021-12-10 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Last VRT activity | 2026-09-29 | Most recent commit touching this CVE's classification, patch or rule file. |
| VulnCheck KEV: latest evidence | 2026-10-12 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |