4 results · Clear filters · Feed
-
Medium 5.4
Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files
Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running without authenticatio…
-
Medium —CVE-2013-6408 EPSS 11%
XML Injection in Apache Solr
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity refe…
-
Medium —CVE-2013-6397 EPSS 57%
Improper Limitation of a Pathname to a Restricted Directory in Apache Solr
Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. …
-
Medium —CVE-2013-6407 EPSS 11%
Apache Solr UpdateRequestHandler for XML resolves XML External Entities
The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.