Skip to content
OpenAdvisories
High 1 exploited CVE USN-7283-1 1 CVE

lucene-solr vulnerability

Published Feb 21, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that the Apache Solr DataImportHandler module incorrectly
handled certain request parameters in a default configuration. A remote
attacker could possibly use this issue to execute arbitrary code.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS lucene-solr 3.6.2+dfsg-2ubuntu0.1~esm4
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS lucene-solr 3.6.2+dfsg-8ubuntu0.1+esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS lucene-solr 3.6.2+dfsg-18~18.04.1~esm2

Vulnerabilities 1

  • High 7.2
    CVE-2019-0193 Exploited Public exploit Scanner template EPSS 84%

    XML External Entity (XXE) Injection in Apache Solr

    In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen…

    Apache Apache Solr org.apache.solr:solr-core lucene-solr Debian Ubuntu Maven
    KEV Dec 10, 2021

References

  • report
    https://ubuntu.com/security/CVE-2019-0193