NetSight
IP …
high7.2Known exploited

CVE-2019-0193

Apache Solr DataImportHandler Code Injection Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-12-10. Federal due date: 2022-06-10.

Apply updates per vendor instructions.

Impact

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.

Affected products

VendorProductAffected versions
ApacheSolr
before 7.7.3
from 8.1.0 before 8.1.2
DebianDebian Linux
Versions 8.0, 9.0

Weakness classification

CWE-94

References