Staging Environment: Content and features may be unstable or change without notice.
Advisory details: project_kb_statements / CVE-2019-0193
Advisory ID project_kb_statements/CVE-2019-0193
Aliases
Summary In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
Status Published
Exploitability 2.0
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
There are no known severity scores.
Reference id Reference type URL
There are no known references.
Data source KEV
Date added Dec. 10, 2021
Description The optional Apache Solr module DataImportHandler contains a code injection vulnerability.
Required action Apply updates per vendor instructions.
Due date June 10, 2022
Note 
https://nvd.nist.gov/vuln/detail/CVE-2019-0193
Ransomware campaign use Unknown

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:04:18Z/

Decision: Attend

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2019/0xxx/CVE-2019-0193.json

Source Advisory: vulnrichment/CVE-2019-0193

View SSVC decision tree 
[{'Exploitation': 'active'},
 {'Automatable': 'no'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]