CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Apache Solr Velocity Template Injection Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2019-17558)
[Affected Scope] Apache Solr versions 5.0.0 through 8.3.1
[Impact] Remote attackers can modify Solr configurations via the Config API to enable the Velocity template loader and execute arbitrary system commands on the host
[Mitigation] Upgrade to Apache Solr 8.4.0 or later, or disable the 'params.resource.loader.enabled' setting and restrict access to the Config API
Apache Solr DataImportHandler Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2019-0193)
[Affected Scope] Apache Solr versions prior to 8.2.0 with the DataImportHandler (DIH) module enabled
[Impact] An authenticated attacker (or an attacker with admin access) can execute arbitrary system commands on the host server by sending a malicious DIH configuration
[Mitigation] Upgrade Apache Solr to version 8.2.0 or higher, or explicitly disable the 'enable.dih.dataConfigParam' Java system property