CVE-2019-0193VulnerabilityPublished 12/10/2021Updated 10/24/2026

CVE-2019-0193: Apache Solr DataImportHandler Code Injection Vulnerability

Affects Apache SolrSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 12/10/2021
KEV deadline: 06/10/2022
EPSS: 83.5% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2019-0193 (opens in a new tab)

Description

Apache Solr's optional DataImportHandler module contains a code injection vulnerability identified as CVE-2019-0193. This vulnerability allows an attacker to inject and execute arbitrary code via the DataImportHandler. It has been observed to be exploited in the wild. No specific affected versions or patch information is provided in the available data.

Summary

CVE-2019-0193 is a code injection vulnerability in the Apache Solr DataImportHandler module. The module, which is optional, can be exploited by attackers to execute arbitrary code on the affected system. This vulnerability has been confirmed to be exploited in the wild, indicating active threat usage. No detailed version information or vendor patch advisory is provided in the input data.

Impact

Successful exploitation of this vulnerability can lead to arbitrary code execution on the server running Apache Solr with the DataImportHandler module enabled. This can compromise the confidentiality, integrity, and availability of the affected system. The presence of known exploitation in the wild increases the risk to affected deployments.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the DataImportHandler module if it is not required, or restrict access to the Solr instance to trusted users only.

Weaknesses

CWE-94Code Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:55:59 UTC

Weaknesses

References

Related threats