vulnerability
Ubuntu: USN-7283-1 (CVE-2019-0193): Apache Solr vulnerability
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 9 | (AV:N/AC:L/Au:S/C:C/I:C/A:C) | Aug 1, 2019 | Feb 24, 2025 | Aug 18, 2025 |
Severity
9
CVSS
(AV:N/AC:L/Au:S/C:C/I:C/A:C)
Published
Aug 1, 2019
Added
Feb 24, 2025
Modified
Aug 18, 2025
Description
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
Solutions
ubuntu-pro-upgrade-liblucene3-contrib-javaubuntu-pro-upgrade-liblucene3-javaubuntu-pro-upgrade-libsolr-java
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.