VulnSocial

CVE-2019-17558(apache / primavera_unifier)

LOWCVSS 7.5 · HIGHCISA KEV

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-05-03. Apply updates per vendor instructions.

Patch / fix
Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-74

Priority

LOW

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • primavera_unifier
  • solr

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Affected systems

Vendors
apacheoracle
Products
primavera_unifiersolr

4 versions affected across 2 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-15: 110-15
Referenced assets1 URL
Full discourse1 post
  • NewNormal Security@NewScanTeam

    NewNormal Security turns CVEs since the previous batch into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 15 Oct 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 📦 Search server on a build with known RCE — a config-API call turns a document update into command execution (Apache Solr CVE-2017-12629, CVE-2019-17558) 📦 Legacy Elasticsearch 1.x — a scripted search runs code on the node, or a crafted plugin/snapshot path reads any file off its disk (Elastic Elasticsearch CVE-2014-3120, CVE-2015-1427, CVE-2015-3337, CVE-2015-5531) 📦 Unpatched CouchDB — an anonymous document promotes itself to database administrator, then runs OS commands (Apache CouchDB CVE-2017-12635, CVE-2017-12636, CVE-2022-24706) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #RCE #CSO #REDTEAM

    0000035
    6 followersView on X
CPE platform detail6 entries

6 of 6 entries

PartVendorProductVersionTarget SWTarget HW
Appapachesolr---
Apporacleprimavera_unifier---
Apporacleprimavera_unifier16.1--
Apporacleprimavera_unifier16.2--
Apporacleprimavera_unifier18.8--
Apporacleprimavera_unifier19.12--

Explore more

Back to dashboardapache CVEsoracle CVEsprimavera_unifier vulnerabilities