Is CVE-2019-0193 exploited in the wild?

Yes. CVE-2019-0193 is known to be exploited in the wild, first recorded on 10 December 2021. Treat it as urgent.

How severe is CVE-2019-0193?

Critical severity, with a CVSS score of 3.1, published 1 August 2019.

Which products and versions are affected?

org.apache.solr:solr-core (Maven) ECOSYSTEM:introduced=0,fixed=8.2.0.

Is there a fix for CVE-2019-0193?

Yes. org.apache.solr:solr-core (Maven): upgrade to 8.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-0193 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-0193?

Check whether you run Apache Solr or org.apache.solr:solr-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-0193: XML External Entity (XXE) Injection in Apache Solr

CVE-2019-0193 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2019-08-01

The Apache Solr DataImportHandler (DIH) module contains a code injection vulnerability via the 'dataConfig' parameter. An attacker can exploit this by providing a malicious configuration containing scripts, which are executed during the DIH debug mode. Starting with version 8.2.0, this parameter is disabled by default.

Technologies: Apache Solr, org.apache.solr:solr-core (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2019-0193 exploited in the wild?: Yes. CVE-2019-0193 is known to be exploited in the wild, first recorded on 10 December 2021. Treat it as urgent.
How severe is CVE-2019-0193?: Critical severity, with a CVSS score of 3.1, published 1 August 2019.
Which products and versions are affected?: org.apache.solr:solr-core (Maven) ECOSYSTEM:introduced=0,fixed=8.2.0.
Is there a fix for CVE-2019-0193?: Yes. org.apache.solr:solr-core (Maven): upgrade to 8.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-0193 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-0193?: Check whether you run Apache Solr or org.apache.solr:solr-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.solr:solr-core (Maven): upgrade to 8.2.0 or later

# set org.apache.solr:solr-core to 8.2.0 in your pom.xml or build.gradle

Affected products

Apache Solr prior to 8.2.0

Identifiers

CVE-2019-0193
GHSA-3gm7-v7vw-866c

Timeline

2021-12-10: disclosed
2021-12-10: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2022-06-10: other: CISA KEV remediation due date

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.