Apache SolrGHSA-3pph-2595-cgfh

There is a XML external entity expansion (XXE) vulnerability in Apache Solr

CVE-2018-1308 · Published Oct 17, 2018 · updated Mar 4, 2024

High7.5

Fix: upgrade to 6.6.3 or later (2 fixed versions below)

This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the &dataConfig=<inlinexml> parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.

Affected versions

Package	Affected	Fixed in
org.apache.solr:solr-core Maven	>= 1.2, < 6.6.3	6.6.3
	>= 7.0.0, < 7.3.0	7.3.0

Details and references

CVSS 3.0: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-611
Also known as: CVE-2018-1308

More Apache Solr advisories

All Apache Solr

High 7.5Mar 14, 2019

Server-Side Request Forgery (SSRF) in org.apache.solr:solr-coreCVE-2017-3164fixed in 7.7.0 Critical 9.8Mar 14, 2019

Critical severity vulnerability that affects org.apache.solr:solr-coreCVE-2019-0192fixed in 7.0.0 High 7.5Oct 18, 2018

Improper Limitation of a Pathname ('Path Traversal') in org.apache.solr:solr-coreCVE-2017-3163fixed in 5.5.4 +1 Critical 9.8Oct 17, 2018

Remote code execution occurs in Apache SolrCVE-2017-12629fixed in 5.5.5 +2 Medium 5.5Oct 17, 2018

There is a XML external entity expansion (XXE) vulnerability in Apache Solr config filesCVE-2018-8010fixed in 6.6.4 +1 Medium 5.5Oct 17, 2018

XML external entity expansion in org.apache.solr:solr-coreCVE-2018-8026fixed in 6.6.5 +1