ZeroDay Findings
Sign inSign up

Findings

CVE-2019-17558

Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability

Published Dec 30, 2019 · updated Jun 16, 2026 · apache solr

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting by defining a response writer with that setting set to . Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is (has been uploaded by an authenticated user).

Timeline

Detection, updates, and resolution for this record.

  1. Dec 30, 2019 · Catalog

    Detected

    Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting by defi

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting by defi

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe apache/solrversion unspecified
  • cpe oracle/primavera unifierversion unspecified
  • cpe oracle/primavera unifier16.1
  • cpe oracle/primavera unifier16.2
  • cpe oracle/primavera unifier18.8
  • cpe oracle/primavera unifier19.12
  • vendor Apache Solrversion unspecified

Sources

  • CISA KEVCVE-2019-17558

    The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution.

    cisa.gov
  • CVE.orgCVE-2019-17558

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2019-17558

    30-day exploitation probability 98.6%

    first.org
  • Exploit Database47572

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database48338

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_multi/http/solr_velocity_rce

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2019-17558

    Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset directory or as a parameter. A user defined configset could contain rende

    nvd.nist.gov

References