Critical Remote Code Execution in Apache Solr VelocityResponseWriter (CVE‑2019‑17558)
What It Is – The Apache Solr VelocityResponseWriter plug‑in contains an unchecked input handling flaw that allows an unauthenticated attacker to execute arbitrary code on the host running Solr.
Exploitability – Publicly disclosed; proof‑of‑concept code exists. The CVSS v3.1 base score is 9.8 (Critical), indicating easy remote exploitation with high impact.
Affected Products – Apache Solr (versions prior to 8.4.1 and 7.7.2) when the VelocityResponseWriter plug‑in is enabled.
Why It Matters for Trust & Control Assurance
- Patch Management & Continuous Monitoring – Demonstrating that you have an up‑to‑date inventory of third‑party components and that patches are applied promptly is a core control evidence point across many frameworks (e.g., NIST CSF 2.0).
- Evidence of Due Diligence – Maintaining audit‑ready logs of vulnerability scans and remediation actions provides defensible proof of a mature security posture that enterprise buyers increasingly demand.
- Defensible Audit Trail – Mapping this RCE to the “Vulnerability Management” control area lets you show regulators and partners that you systematically identify, assess, and remediate critical flaws.
Recommended Actions
- Verify Solr version and whether the VelocityResponseWriter plug‑in is enabled.
- Upgrade to Apache Solr 8.4.1 or 7.7.2 (or later) where the issue is patched.
- If immediate upgrade is not possible, disable the plug‑in or apply the vendor‑provided mitigation.
- Run an internal vulnerability scan to confirm no other instances remain vulnerable.
- Document remediation steps in your control‑mapping repository to generate audit‑ready evidence.
Source: CISA KEV – CVE‑2019‑17558