CVE-2019-0193
Description
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
How to fix
Apply updates per vendor instructions.
CISA due date: Jun 10, 2022- apache solr7.7.3, 8.1.2 or later
- org.apache.solr:solr-core8.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache solr | v < 7.7.3, 8.1.0 ≤ v < 8.1.2 | 7.7.3, 8.1.2 |
| debian debian_linux | 8.0, 9.0 | — |
| org.apache.solr:solr-coreMaven | v < 8.2.0 | 8.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.