AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SolrGHSA-v6gf-x8fp-532v

Improper Neutralization of Input During Web Page Generation in Apache Solr

Apache Solr

CVE-2015-8797 · Published May 17, 2022 · updated Nov 8, 2023

Medium6.1
Fix: upgrade to 5.3.1 or later
GitHub advisory

Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via the entry parameter to a plugins/cache URI.

Affected versions

PackageAffectedFixed in
org.apache.solr:solr-core
Maven
< 5.3.15.3.1
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-79
Also known as
CVE-2015-8797

More Apache Solr advisories

All Apache Solr
HighMay 17, 2022Improper Restriction of XML External Entity Reference in Apache SolrCVE-2012-6612fixed in 4.1.0MediumMay 17, 2022XML Injection in Apache SolrCVE-2013-6408fixed in 4.3.1MediumMay 17, 2022Apache Solr UpdateRequestHandler for XML resolves XML External EntitiesCVE-2013-6407fixed in 4.1.0MediumMay 17, 2022Improper Limitation of a Pathname to a Restricted Directory in Apache SolrCVE-2013-6397fixed in 4.6.0Medium 6.1May 17, 2022Improper Neutralization of Input During Web Page Generation in Apache SolrCVE-2015-8795fixed in 5.1.0High 7.5May 14, 2022Apache Solr insecure inter-node communicationCVE-2017-7660fixed in 5.5.5 +1