CVE-2019-0193

Basic Information

CVE State

PUBLISHED

Reserved Date

November 14, 2018

Published Date

August 01, 2019

Last Updated

February 06, 2025

Vendor

Apache

Product

Apache Solr

Description

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.

CVSS Scores

SSVC Information

Exploitation

active

Technical Impact

total

Exploit Status

Exploited in the Wild

Yes (added 2021-12-10 00:00:00 UTC) Source

Proof of Concept Available

Yes (added 2019-03-18 13:18:01 UTC) Source