VulnerableCode Advisory Details

Data source	KEV
Date added	Dec. 10, 2021
Description	The optional Apache Solr module DataImportHandler contains a code injection vulnerability.
Required action	Apply updates per vendor instructions.
Due date	June 10, 2022
Note	https://nvd.nist.gov/vuln/detail/CVE-2019-0193
Ransomware campaign use	Unknown

No EPSS data available for this advisory.

Patch URL
There are no known patches.

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at None

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:04:18Z/ Found at None

Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:04:18Z/

Decision: Attend

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2019/0xxx/CVE-2019-0193.json

Source Advisory: vulnrichment/CVE-2019-0193

View SSVC decision tree

[{'Exploitation': 'active'},
 {'Automatable': 'no'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]

Advisory ID	vulnrichment/CVE-2019-0193
Aliases
Summary	In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
Status	Published
Exploitability	0.5
Weighted Severity	0.0
Risk
Affected and Fixed Packages	Package Details
Introduced and Fixed Package Commit Patches	Package Commit Patches Details