CVE-2019-17558 Apache Solr
| Affected software | Apache Solr |
|---|---|
| Severity | 7.5 High CVSS 3.1 3 scores |
| Fixed in | 8.4.0 |
| Weakness | Code injection (CWE-94) |
| Published | 30 Dec 2019 |
| Updated | 29 Sep 2026 |
Description
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting params.resource.loader.enabled by defining a response writer with that setting set to true. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is trusted (has been uploaded by an authenticated user).
CWE-74CWE-20 · Improper input validation
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2021-11-03 · remediation due 2022-05-03 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 3 citations · honeypot sightings · 3 exploits · earliest 2021-11-03.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: total.
- Indexed PoC 10 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2019-11-01.
- EPSS 99% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2019-17558 in VulnCheck (free account).
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | Shadowserver honeypots | Exploitation attempts seen on 6 days | 2026-07-09 to 2026-11-09 |
| Honeypot sighting | VulnCheck canaries | Exploitation attempts seen on 30 days | 2026-10-15 to 2026-11-13 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2021-11-03 |
| Reported exploitation | 25491742.fs1.hubspotusercontent-eu1.net | /hubfs/25491742/WAZAWAKA_TLPCLEAR_Report.pdf | 2023-12-20 |
| Reported exploitation | trustwave.com | /en-us/resources/blogs/spiderlabs-blog/lessons-from-a-honeypot-with-us-citizens-data | 2024-11-13 |
| Exploit reference | VulnCheck XDB 7bb322405f10 | Exploit type: initial-access | 2020-04-01 |
| Exploit reference | VulnCheck XDB 6918ed306441 | Exploit type: initial-access | 2024-10-22 |
| Exploit reference | VulnCheck XDB 66f599e68bd2 | Exploit type: initial-access | 2026-10-08 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340 | 4,297 | 2020-04-01 |
| GitHub PoC | Solr_CVE-2019-17558 | 2 | 2020-08-04 |
| GitHub PoC | rogerzeferino/cve-2019-17558-apache-solr-rce | 1 | 2026-02-16 |
| GitHub PoC | CVE-2019-17558 Solr模板注入漏洞图形化一键检测工具。CVE-2019-17558 Solr Velocity Template Vul POC Tool. | 1 | 2020-03-27 |
| GitHub PoC | Vulhub solr/CVE-2019-17558: Apache Solr Velocity Template RCE (CVE-2019-17558), run with Isoloom | 2026-10-08 | |
| GitHub PoC | Apache Solr 1.4 Injection to get a shell | 2020-12-15 | |
| Exploit-DB | Apache Solr - Remote Code Execution via Velocity Template (Metasploit) | 2020-04-16 | |
| Exploit-DB | Apache Solr 8.2.0 - Remote Code Execution | 2019-11-01 | |
| Nuclei | Apache Solr <=8.3.1 - Remote Code Execution | ||
| Metasploit | Apache Solr Remote Code Execution via Velocity Template (excellent rank) |
Waratek protection
Waratek has a rule that blocks the main way to exploit this vulnerability, but a public exploit or tool gets past it.
- Protection partial Process
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE partially protected by the ARMR Process rule: a public exploit or tool reaches the rated impact without tripping it. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR Process rule
Solr Velocity template injection via v.template.custom; the Process rule (with /bin/* and /usr/* listed) blocks the Runtime.exec that the nuclei, Exploit-DB 47572 and Metasploit command-target exploits run. Metasploit's default Java target loads its payload into the running application without starting a program or writing a file, and is not stopped.
How to mitigate CVE-2019-17558
Upgrade Apache Solr to 8.4.0 or later. Until you can, Waratek RASP blocks the main way to exploit it with its process rule, but a public exploit or tool gets past it. The research note above says which.
Waratek RASP Runtime protection for Java applications
CVSS
7.5 HIGH
v3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
7.5 HIGH v3.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 4.6 | none | AV:N/AC:H/Au:S/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2020 ↗ | CPU | 2020-Q4 | Oracle Construction and Engineering / Platform (Apache Solr) (16.1, 16.2, 17.7-17.12, 18.8, 19.12) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Construction and Engineering | Platform (Apache Solr) | 16.1, 16.2, 17.7-17.12, 18.8, 19.12 | 16.1 · 16.2 · 18.8 · 19.12 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.solr:solr-core |
5.0.0 | 8.4.0 |
unbounded |
org.apache.solr:solr-core |
6.0.0 | 8.4.0 |
unbounded |
org.apache.solr:solr-core |
7.0.0 | 8.4.0 |
unbounded |
org.apache.solr:solr-core |
8.0.0 | 8.4.0 |
unbounded |
Products and versions
3 products, 11 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | solr | generic | ≥ 5.0.0 and ＜ 7.7.3 · ≥ 8.0.0 and ＜ 8.4.0 |
| nvd | oracle | primavera unifier | generic | 16.1 · 16.2 · ≥ 17.7 and ≤ 17.12 · 18.8 · 19.12 |
| osv | org.apache.solr | solr-core | generic | ≥ 5.0.0 and ＜ 8.4.0 · ≥ 6.0.0 and ＜ 8.4.0 · ≥ 7.0.0 and ＜ 8.4.0 · ≥ 8.0.0 and ＜ 8.4.0 |
References
Timeline
Timeline
| Published | 2019-12-30 | By the CVE Program. |
|---|---|---|
| Added to CISA KEV | 2021-11-03 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| VulnCheck KEV: earliest evidence | 2021-11-03 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Last VRT activity | 2026-09-29 | Most recent commit touching this CVE's classification, patch or rule file. |
| VulnCheck KEV: latest evidence | 2026-11-13 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |