AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SolrGHSA-mx2h-hf7j-2x3p

Improper Neutralization of Input During Web Page Generation in Apache Solr

Apache Solr

CVE-2015-8795 · Published May 17, 2022 · updated Nov 8, 2023

Medium6.1
Fix: upgrade to 5.1.0 or later
GitHub advisory

Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary web script or HTML via crafted fields that are mishandled during the rendering of the (1) Analysis page, related to webapp/web/js/scripts/analysis.js or (2) Schema-Browser page, related to webapp/web/js/scripts/schema-browser.js.

Affected versions

PackageAffectedFixed in
org.apache.solr:solr-core
Maven
< 5.1.05.1.0
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-79
Also known as
CVE-2015-8795

More Apache Solr advisories

All Apache Solr
HighMay 17, 2022Improper Restriction of XML External Entity Reference in Apache SolrCVE-2012-6612fixed in 4.1.0MediumMay 17, 2022XML Injection in Apache SolrCVE-2013-6408fixed in 4.3.1MediumMay 17, 2022Apache Solr UpdateRequestHandler for XML resolves XML External EntitiesCVE-2013-6407fixed in 4.1.0MediumMay 17, 2022Improper Limitation of a Pathname to a Restricted Directory in Apache SolrCVE-2013-6397fixed in 4.6.0Medium 6.1May 17, 2022Improper Neutralization of Input During Web Page Generation in Apache SolrCVE-2015-8797fixed in 5.3.1High 7.5May 14, 2022Apache Solr insecure inter-node communicationCVE-2017-7660fixed in 5.5.5 +1