Reference page — cumulative record through Wednesday, October 7, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L H N U H H H 7.2 .8355 99.7 YES
AFFECTED Product Versions Fixed Apache Solr Apache Solr all prior to 8.2.0 – —
TIMELINE Nov 14 Reserved by apache Aug 1 Published (CNA: apache) Dec 10 Added to CISA KEV, remediation due 2022-06-10
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
| Date | Event | Detail |
|---|---|---|
| November 14, 2018 | Reserved | Reserved by apache |
| August 1, 2019 | Published | Published (CNA: apache) |
| December 10, 2021 | KEV ADDED | Added to CISA KEV, remediation due 2022-06-10 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Apache | Apache Solr | — | Apache Solr all prior to 8.2.0 | — |
Authoritative record: CVE-2019-0193 at cve.org
Vendors: apache
Weaknesses: CWE-94
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2019-0193 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, October 7, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
