CVE-2019-0193: XML External Entity (XXE) Injection in Apache Solr
Summary
CVE-2019-0193: XML External Entity (XXE) Injection in Apache Solr. Affects org.apache.solr:solr-core versions < 8.2.0. Fixed in 8.2.0. How to fix ↓
Also tracked for
- lucene-solr · Debian:11
The same CVE-2019-0193 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It provides full-text search, hit highlighting, faceted search, distributed search, and more. The DataImportHandler (DIH) is an optional module in Solr used to import data from various sources, including databases. The DIH configuration can be provided through a request's "dataConfig" parameter, which is a security risk. Starting from version 8.2.0 of Solr, the use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
Vulnerability Detail
The XML External Entity (XXE) Injection vulnerability in Apache Solr affects versions prior to 8.2.0. The DIH module allows the DIH configuration to be specified through a request parameter, which can include scripts. This feature can be exploited by an attacker to execute arbitrary code, read sensitive data, or cause a denial of service. The vulnerability has a CVSS score of 7.2, indicating a high severity.
How To Fix
Latest published version: 10.0.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a workaround is to disable the use of the "dataConfig" parameter or restrict its usage to trusted sources only. This can be achieved by modifying the Solr configuration and implementing proper input validation and sanitization.
Conclusion
The XML External Entity (XXE) Injection vulnerability in Apache Solr can be mitigated by upgrading to version 8.2.0 or later and enabling the secure usage of the "dataConfig" parameter. It is crucial to promptly address this vulnerability to protect the confidentiality, integrity, and availability of the Solr instance. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.solr:solr-core →
FAQ
Apache Solr is an open-source search platform built on Apache Lucene. It provides advanced search capabilities and is widely used for building search applications.
The DataImportHandler is an optional module in Apache Solr used to import data from various sources, such as databases, XML files, and more. It allows Solr to pull in data and index it for search.
XML External Entity (XXE) Injection is a vulnerability that occurs when an application processes XML input without properly validating or sanitizing it. Attackers can exploit this vulnerability to read sensitive data, execute arbitrary code, or perform denial of service attacks.
Exploiting this vulnerability can lead to unauthorized access to sensitive data, execution of arbitrary code, or disruption of service availability. It poses a significant risk to the confidentiality, integrity, and availability of the affected system.
To mitigate the risk, it is recommended to upgrade to Apache Solr version 8.2.0 or later. Additionally, ensure that the Java System property "enable.dih.dataConfigParam" is set to true to enable secure usage of the "dataConfig" parameter.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.solr:solr-core.
