CVE-2019-17558

Confirmed PUBLISHED

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be...

Apache · Apache Solr

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

7.5 High EPSS 98.6%

At a Glance

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).

metasploit apache cisa nuclei_scanner

CVE Published: Dec 30, 2019
Exploitation Reported: Nov 03, 2021
CVSS: 7.5 High
EPSS: 98.6%

Remote No user interaction

Affected Versions

Vendor	Product	Version	Status
n/a	Apache Solr	Apache Solr 5.0.0 to Apache Solr 8.3.1	Affected

CVE References

[lucene-issues] 20200107 [jira] [Commented] (SOLR-13971) CVE-2019-17558: Velocity custom template RCE vulnerability lists.apache.org · Mailing List https://lists.apache.org/thread.html/rb964fe5c4e3fc05f75e8f74bf6b885f...
[lucene-issues] 20200108 [jira] [Commented] (SOLR-13971) CVE-2019-17558: Velocity custom template RCE vulnerability lists.apache.org · Mailing List https://lists.apache.org/thread.html/r9271d030452170ba6160c022757e1b5...
[lucene-issues] 20200108 [jira] [Updated] (SOLR-14025) CVE-2019-17558: Velocity response writer RCE vulnerability persists after 8.3.1 lists.apache.org · Mailing List https://lists.apache.org/thread.html/ra29fa6ede5184385bf2c63e8ec05499...
[lucene-issues] 20200108 [GitHub] [lucene-solr] Sachpat opened a new pull request #1156: SOLR-13971 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r36e35fd76239a381643555966fb3e72...
[lucene-issues] 20200108 [GitHub] [lucene-solr] Sachpat commented on a change in pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability lists.apache.org · Mailing List https://lists.apache.org/thread.html/r5074d814d3a8c75df4b20e66bfd268e...

Show 24 more references

[lucene-issues] 20200108 [GitHub] [lucene-solr] artem-smotrakov commented on a change in pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability lists.apache.org · Mailing List https://lists.apache.org/thread.html/rf6d7ffae2b940114324e036b6394bea...
[lucene-issues] 20200108 [GitHub] [lucene-solr] Sachpat commented on issue #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability lists.apache.org · Mailing List https://lists.apache.org/thread.html/r58c58fe51c87bc30ee13bb8b4c83587...
[lucene-issues] 20200113 [GitHub] [lucene-solr] Sachpat closed pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability lists.apache.org · Mailing List https://lists.apache.org/thread.html/r25f1bd4545617f5b86dde27b4c30fec...
[lucene-issues] 20200113 [jira] [Commented] (SOLR-14025) CVE-2019-17558: Velocity response writer RCE vulnerability persists after 8.3.1 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r12ab2cb15a34e49b4fecb5b2bdd7e10...
[lucene-issues] 20200113 [GitHub] [lucene-solr] chatman commented on issue #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability lists.apache.org · Mailing List https://lists.apache.org/thread.html/r99c3f7ec3a079e2abbd540ecdb55a0e...
[lucene-issues] 20200113 [GitHub] [lucene-solr] Sachpat commented on issue #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability lists.apache.org · Mailing List https://lists.apache.org/thread.html/r0b7b9d4113e6ec1ae1d3d0898c645f7...
[lucene-dev] 20200213 Re: 7.7.3 bugfix release lists.apache.org · Mailing List https://lists.apache.org/thread.html/r339865b276614661770c909be1dd7e8...
[lucene-dev] 20200214 Re: 7.7.3 bugfix release lists.apache.org · Mailing List https://lists.apache.org/thread.html/r19d23e8640236a3058b4d6c23e5cd66...
[lucene-issues] 20200219 [jira] [Updated] (SOLR-14025) CVE-2019-17558: Velocity response writer RCE vulnerability persists after 8.3.1 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rafc939fdd753f55707841cd5886fc7f...
[ambari-issues] 20200220 [jira] [Created] (AMBARI-25482) solr dependence CVE-2019-17558 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rde3dbd8e646dabf8bef1b097e9a13ee...
[lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc09...
[lucene-solr-user] 20200320 Re: CVEs (vulnerabilities) that apply to Solr 8.4.1 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rf5230a049d989dbfdd404b4320a265d...
[submarine-commits] 20201209 [GitHub] [submarine] QiAnXinCodeSafe opened a new issue #474: There is a vulnerability in Apache Solr 5.5.4,upgrade recommended lists.apache.org · Mailing List https://lists.apache.org/thread.html/rc400db37710ee79378b6c52de364049...
[lucene-solr-user] 20210203 Re: SolrCloud keeps crashing lists.apache.org · Mailing List https://lists.apache.org/thread.html/r79c7e75f90e735fd32c4e3e97340625...
[lucene-issues] 20210210 [GitHub] [lucene-solr] rhtham edited a comment on pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability lists.apache.org · Mailing List https://lists.apache.org/thread.html/re8d12db916b5582a23ed144b9c5abd0...
[lucene-issues] 20210210 [GitHub] [lucene-solr] rhtham commented on pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability lists.apache.org · Mailing List https://lists.apache.org/thread.html/r8a36e4f92f4449dec517e560e1b5563...
[lucene-solr-user] 20210212 CVE-2019-17558 on SOLR 6.1 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r7b89b3dcfc1b6c52dd8d610b897ac98...
[lucene-solr-user] 20210212 Re: CVE-2019-17558 on SOLR 6.1 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r8e7a3c253a695a7667da0b0ec57f9bb...
[lucene-solr-user] 20210213 Re: CVE-2019-17558 on SOLR 6.1 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r5dc200f7337093285bac40e6d5de5ea...
[lucene-issues] 20210315 [GitHub] [lucene-solr] erikhatcher commented on pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability lists.apache.org · Mailing List https://lists.apache.org/thread.html/r7f21ab40a9b17b1a703db84ac56773f...
[druid-commits] 20210324 [GitHub] [druid] jihoonson opened a new pull request #11030: Suppress cves lists.apache.org · Mailing List https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8c...
oracle.com/security-alerts/cpuoct2020.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpuoct2020.html
issues.apache.org/jira/browse/SOLR-13971 issues.apache.org · CVE Record https://issues.apache.org/jira/browse/SOLR-13971
packetstormsecurity.com/files/157078/Apache-Solr-8.3.0-Velocity-Temp... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/157078/Apache-Solr-8.3.0-Velocit...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2021-11-03 00:00 UTC
The Shadowserver	2026-07-09 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17558.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/solr_velocity_rce.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 7.5 High

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 4.6 Medium

AV:N/AC:H/Au:S/C:P/I:P/A:P

Exploitation Status

Exploited in the wild

Recorded 2021-11-03 00:00:00 UTC · CISA

Proof of concept available

Recorded 2020-08-04 06:13:33 UTC · GitHub

Weaknesses (CWE)

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/solr_velocity_rce.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17558.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Ma1Dong/Solr_CVE-2019-17558

github · Created 2020-08-04 06:13:33 UTC · 2 stars

Solr_CVE-2019-17558

Apache Solr <=8.3.1 - Remote Code Execution

nuclei · Created Unknown

solr_velocity_rce

metasploit · Created Unknown

Metasploit module for CVE-2019-17558

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2019-17558

{
  "cve_id": "CVE-2019-17558",
  "title": "Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execut...",
  "affected_vendor": "Apache",
  "affected_product": "Apache Solr",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 7.5,
  "epss_score": 0.98567,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2019-17558

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API