VYPR
Get started
← All advisories
High severityCISA KEVNVD Advisory· Published Aug 1, 2019· Updated Oct 21, 2025

CVE-2019-0193

CVE-2019-0193

Description

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.solr:solr-coreMaven
< 8.2.08.2.0

Affected products

1
  • Apache/Apache Solrv5
    Range: Apache Solr all prior to 8.2.0

Patches

1
02c693f3713a
https://github.com/apache/lucene-solrvia ghsa
commit

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

46

News mentions

0

No linked articles in our index yet.