{"cve":"CVE-2019-0193","nvd":{"published":"2019-08-01T14:15:13.113","modified":"2026-06-17T02:07:55.447","status":"Analyzed","description":"In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's \"dataConfig\" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property \"enable.dih.dataConfigParam\" to true.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2},"cwes":["CWE-94"],"references":["https://issues.apache.org/jira/browse/SOLR-13669","https://lists.apache.org/thread.html/1addbb49a1fc0947fb32ca663d76d93cfaade35a4848a76d4b4ded9c%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/42cc4d334ba33905b872a0aa00d6a481391951c8b1450f01b077ce74%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/55880d48e38ba9e8c41a3b9e41051dbfdef63b86b0cfeb32967edf03%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/6f2d61bd8732224c5fd3bdd84798f8e01e4542d3ee2f527a52a81b83%40%3Cissues.lucene.apache.org%3E"],"products":["apache:solr","debian:debian_linux"],"source":"nvd","synced_at":"2026-10-19T20:58:11.797917892+00:00"},"epss":{"cve":"CVE-2019-0193","score":0.83547,"percentile":0.99686,"date":"2026-10-31"},"kev":{"cve":"CVE-2019-0193","date_added":"2021-12-10","due_date":"2022-06-10","vendor":"Apache","product":"Solr","known_ransomware":false},"osv":[{"id":"GHSA-3gm7-v7vw-866c","url":"https://osv.dev/vulnerability/GHSA-3gm7-v7vw-866c","summary":"XML External Entity (XXE) Injection in Apache Solr","modified":"2025-10-22T19:31:54.544665Z","packages":[{"ecosystem":"Maven","name":"org.apache.solr:solr-core","purl":"pkg:maven/org.apache.solr/solr-core","ranges":["<8.2.0"],"fixed":["8.2.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}