CVE-2019-17558

mediumpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.986 · 100 %ileexploit · weaponizedDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 8 exploits · weaponized

Likely / severe?

98.6% (100th) EPSS

CVSS 4.6 · medium

Is it mine?

26 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2021-11-03remediate by 2022-05-03

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-27

Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.6–7.5

v2.04.6mediumAV:N/AC:H/Au:S/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 3.9 · impact 6.4

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.6 · impact 5.9

v3.17.5highAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 1.6 · impact 5.9

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · OSV

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-74USprimaryCWE-20USCWE-20USCWE-74USCWE-94US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (8)

Public proof-of-concept and weaponised exploit code.

exploit/multi/http/solr_velocity_rceApache Solr Remote Code Execution via Velocity Templateweaponized · metasploit
EDB-48338Apache Solr - Remote Code Execution via Velocity Template (Metasploit)functional · exploit_db
EDB-47572Apache Solr 8.2.0 - Remote Code ExecutionPoC · exploit_db
CyberCTF/vulhub-solr-cve-2019-17558Vulhub solr/CVE-2019-17558: Apache Solr Velocity Template RCE (CVE-2019-17558), run with IsoloomPoC · poc_in_github
Ma1Dong/Solr_CVE-2019-17558Solr_CVE-2019-17558PoC · poc_in_github
rogerzeferino/cve-2019-17558-apache-solr-rcerogerzeferino/cve-2019-17558-apache-solr-rcePoC · poc_in_github

affected products (26)

Products and version ranges known to be affected.

EMC Avamarall versionscert_bundDEcpe:/a:emc:avamar:-
IBM Tivoli Network Manager 4.2.0all versionscert_bundDEcpe:/a:ibm:tivoli_network_manager:4.2.0
Oracle Construction and Engineeringall versionscert_bundDEcpe:/a:oracle:construction_and_engineering:-
n/a Apache Solr≤ Apache Solr 5.0.0 to Apache Solr 8.3.1enisa_euvdEU
Apache Software Foundation Solr5.0.0 → 8.3.1fstec_bduRU
Canonical Ltd. Ubuntu≤ 20.04 LTSfstec_bduRU
Canonical Ltd. Ubuntu≤ 18.04 LTSfstec_bduRU
Canonical Ltd. Ubuntu≤ 20.10fstec_bduRU
Oracle Corp. Primavera Unifier≤ 18.8fstec_bduRU
Oracle Corp. Primavera Unifier≤ 16.1fstec_bduRU
Oracle Corp. Primavera Unifier≤ 16.2fstec_bduRU
Oracle Corp. Primavera Unifier≤ 19.12fstec_bduRU
Oracle Corp. Primavera Unifier17.7 → 17.12fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 9fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 10fstec_bduRU
apache solr5.0.0 → 7.7.3nvdUScpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*
apache solr8.0.0 → 8.4.0nvdUScpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*
oracle primavera unifier= 16.1nvdUScpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
oracle primavera unifier= 16.2nvdUScpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
oracle primavera unifier17.7 → 17.12nvdUScpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*

showing 20 of 26

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-1048Oracle Construction and Engineering: Mehrere SchwachstellenDeutsch2020-10-20csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Construction and Engineering ausnutzen, um die Verfügbarkeit, Vertraulichkeit und Integrität zu gefährden.
GHSA-ww97-9w65-2crxImproper Input Validation in Apache Solr2020-02-12ghsa · osvUS
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd osv NVD CVE.org MITRE

published 2019-12-30modified 2026-08-12

related (5,984)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2025-20337US	—OT critical	74.5% (99th)	KEV	2025-07-16
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as roo…
CVE-2025-20281US	—OT critical	97.6% (100th)	KEV	2025-06-25
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as roo…
CVE-2023-22527US	critical9.8OT critical	100.0% (100th)	KEV	2024-01-16
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using…
CVE-2023-48365US	critical9.9OT critical	47.7% (99th)	KEV	2023-11-15
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attack…
CVE-2023-37580US	medium6.1OT critical	49.1% (99th)	KEV	2023-07-31
Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

+5979 more

references (95)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan