CVE-2019-0193
Apache Solr DataImportHandler Code Injection Vulnerability
Published Aug 1, 2019 · updated Jun 16, 2026 · apache solr
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
Timeline
Detection, updates, and resolution for this record.
Aug 1, 2019 · Catalog
Detected
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security
Dec 10, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jun 10, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security
Required action
Apply updates per vendor instructions.
CISA due date Jun 10, 2022
Affected
- cpe apache/solrversion unspecified
- cpe debian/debian linux8.0
- cpe debian/debian linux9.0
- vendor Apache Solrversion unspecified
Sources
- CISA KEVCVE-2019-0193
The optional Apache Solr module DataImportHandler contains a code injection vulnerability.
cisa.gov - CVE.orgCVE-2019-0193
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-0193
30-day exploitation probability 83.5%
first.org - NIST NVDCVE-2019-0193
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow c
nvd.nist.gov