Skip to content
THREATWIRE

CVE Tracker

CVE-2019-17558

Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability

IN CISA KEV

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).

Vendor
Apache
Product
Solr
CVSS 3.1
7.5 (high), scored by NVD (primary)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
7.5 (high), scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-74
Published
2019-12-30
NVD modified
2026-06-17
NVD status
Analyzed

CISA KEV

Date added
2021-11-03
Due date
2022-05-03
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.

EPSS

98.6% chance of exploitation in the next 30 days (percentile 99th)

FIRST EPSS, updated 17 Oct 2026. About EPSS

CVSS is severity, EPSS is likelihood, KEV means already exploited. EPSS is a statistical probability, not a certainty: a low score does not make a bug safe, and a high one does not prove it is being exploited.

References

Data last updated 18 Oct 2026. Sources: NVD API 2.0, CISA KEV catalog, FIRST EPSS. Links: NVD, CISA KEV. Metadata only. ThreatWire does not host exploit code.