CVE-2019-0193 KEVPublic exploit High · 7.2 EPSS 83.5%

Apache Solr DataImportHandler Code Injection Vulnerability

Summary

Apache Solr's DataImportHandler module, which pulls data from databases and other sources, accepts a full DIH configuration through a request's "dataConfig" parameter, used by the admin screen's debug mode. Because a DIH configuration can contain scripts, an attacker with network access and high-privilege credentials can inject code through this parameter, and the feature remains exposed in Solr 8.2.0 and later unless the Java system property "enable.dih.dataConfigParam" is set to true to enable it.

Official description · NVD

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.

Breakdown

68.0 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationAI-written (claude-haiku-5-5)Medium confidence149 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterAI-written (claude-haiku-5-5)Medium confidence95 general detection rules

First seen exploited 6 months after disclosure. Public exploit code (PoC-in-GitHub) was available 4 months before disclosure.

Public exploit codePoC-in-GitHub18 Mar 20194 mo before
Disclosed1 Aug 2019day 0
First seen exploitedVulnCheck KEV evidence16 Jan 2020+6 mo
Added to CISA KEVEU database agrees10 Dec 2021+2 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

2 related vulnerabilities in the same code over 16 months. The latest fix listed for solr-core is 8.6.3.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2018-1308This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to…9 Apr 2018
relatedMedium
Why these are linked:
- Same code patched: DataImporter.java (machine-matched)Functions: getSchema, loadDataConfigcommit 3530397 commit 739a793 commit 02c693f
This CVECVE-2019-0193Solr DataImportHandler Code Injection1 Aug 2019KEV

Fixes in solr-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

7.4.0CVE-2018-80265 Jul 2018
7.7.0CVE-2017-31648 Mar 2019
7.7.0CVE-2018-118021 Apr 2020
8.2.0CVE-2019-01931 Aug 2019KEV
8.3.0CVE-2019-1240918 Nov 2019
8.4.0CVE-2019-1755830 Dec 2019KEV
8.6.3CVE-2020-1395713 Oct 2020Latest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

AI mapping from the description · how it is exploited

remote request parameter is the attack entry point

has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter

From the official description (NVD) Original ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

AI mapping from the description · primary impact

injected scripts execute as code

Since a DIH config can contain scripts, this parameter is a security risk

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2019-0193 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.solr:solr-core.

Mavenorg.apache.solr:solr-coreGHSA-3gm7-v7vw-866c

Upgrade to 8.11.3 or later

Fixes this CVE and 6 other known vulnerabilities in this package (CVE-2013-6397, CVE-2017-12629, +4).

Set the version to 8.11.3 or later in your pom.xml or build.gradle.

First fixed in 8.2.0 for CVE-2019-0193.

Affected versions

If you run	Upgrade to
All versions before 8.2.0	8.11.3first fix for this CVE: 8.2.0

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

23 links, grouped by NVD tag (22 duplicates merged)

Show 9 moreShow fewer

Exploitation evidence

Exploited in the wild

Listed since 10 Dec 2021. Federal due date 10 Jun 2022. No recorded ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 10 Dec 2021. EUVD-2019-0615

Public exploitAdvisories link exploit code.

, 30 Oct 2026

83.5%Top 0.31%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.69%).

3.1

7.2High · 7.2

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 2480 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9969 19.9/20

Threat reports0 reports 0.0/10

Public exploit code5 PoC-in-GitHub repos; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 7.2 5.0/7

End-of-life productsupported or unknown 0.0

Total68.0

Record

Published: 1 Aug 2019
Modified: 17 Jun 2026
: CWE-94 Improper Control of Generation of Code
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in solr-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

Patch 2

US Government Resource 1

Third Party Advisory 2

Mailing List 17

How attackers get in

What they do

techniques