CVE-2013-6407
published 2013-12-07CVE-2013-6407: The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity…
PriorityP341medium6.4CVSS 2.0
AVNACLAuNCPINAP
EPSS
11.40%
95.5th percentile
The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | solr | <= 4.0.0 | — |
| apache | solr | <= 4.3.0 | — |
| apache | solr | — | — |
| apache | solr | — | — |
| apache | solr | — | — |
| apache | solr | — | — |
| apache | solr | — | — |
| apache | solr | — | — |
| apache | solr | — | — |
| debian | lucene-solr | < lucene-solr 3.6.2+dfsg-2 (bookworm) | lucene-solr 3.6.2+dfsg-2 (bookworm) |
CVSS provenance
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
ghsa6.4MEDIUM
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache Solr UpdateRequestHandler for XML resolves XML External Entities
osv·2022-05-17
CVE-2013-6407 [MEDIUM] Apache Solr UpdateRequestHandler for XML resolves XML External Entities
Apache Solr UpdateRequestHandler for XML resolves XML External Entities
The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
GHSA
Improper Restriction of XML External Entity Reference in Apache Solr
ghsa·2022-05-17·CVSS 6.4
CVE-2012-6612 [MEDIUM] CWE-611 Improper Restriction of XML External Entity Reference in Apache Solr
Improper Restriction of XML External Entity Reference in Apache Solr
The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407.
GHSA
XML Injection in Apache Solr
ghsa·2022-05-17·CVSS 6.4
CVE-2013-6408 [MEDIUM] CWE-91 XML Injection in Apache Solr
XML Injection in Apache Solr
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
GHSA
Apache Solr UpdateRequestHandler for XML resolves XML External Entities
ghsa·2022-05-17
CVE-2013-6407 [MEDIUM] CWE-611 Apache Solr UpdateRequestHandler for XML resolves XML External Entities
Apache Solr UpdateRequestHandler for XML resolves XML External Entities
The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
OSV
XML Injection in Apache Solr
osv·2022-05-17·CVSS 6.4
CVE-2013-6408 [MEDIUM] XML Injection in Apache Solr
XML Injection in Apache Solr
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
OSV
Improper Restriction of XML External Entity Reference in Apache Solr
osv·2022-05-17·CVSS 6.4
CVE-2012-6612 [MEDIUM] Improper Restriction of XML External Entity Reference in Apache Solr
Improper Restriction of XML External Entity Reference in Apache Solr
The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407.
OSV
CVE-2013-6408: The DocumentAnalysisRequestHandler in Apache Solr before 4
osv·2013-12-07·CVSS 6.4
CVE-2013-6408 [MEDIUM] CVE-2013-6408: The DocumentAnalysisRequestHandler in Apache Solr before 4
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
OSV
CVE-2013-6407: The UpdateRequestHandler for XML in Apache Solr before 4
osv·2013-12-07·CVSS 6.4
CVE-2013-6407 [MEDIUM] CVE-2013-6407: The UpdateRequestHandler for XML in Apache Solr before 4
The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
OSV
CVE-2012-6612: The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4
osv·2013-12-07·CVSS 7.5
CVE-2012-6612 [HIGH] CVE-2012-6612: The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4
The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407.
Red Hat
Solr: XML eXternal Entity (XXE) flaw in DocumentAnalysisRequestHandler
vendor_redhat·2013-05-31·CVSS 6.4
CVE-2013-6408 [MEDIUM] Solr: XML eXternal Entity (XXE) flaw in DocumentAnalysisRequestHandler
Solr: XML eXternal Entity (XXE) flaw in DocumentAnalysisRequestHandler
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
Debian
CVE-2013-6408: lucene-solr - The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly...
vendor_debian·2013·CVSS 6.4
CVE-2013-6408 [MEDIUM] CVE-2013-6408: lucene-solr - The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly...
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
Scope: local
bookworm: resolved (fixed in 3.6.2+dfsg-2)
bullseye: resolved (fixed in 3.6.2+dfsg-2)
forky: resolved (fixed in 3.6.2+dfsg-2)
sid: resolved (fixed in 3.6.2+dfsg-2)
trixie: resolved (fixed in 3.6.2+dfsg-2)
Debian
CVE-2013-6407: lucene-solr - The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attacke...
vendor_debian·2013·CVSS 6.4
CVE-2013-6407 [MEDIUM] CVE-2013-6407: lucene-solr - The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attacke...
The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Scope: local
bookworm: resolved (fixed in 3.6.2+dfsg-2)
bullseye: resolved (fixed in 3.6.2+dfsg-2)
forky: resolved (fixed in 3.6.2+dfsg-2)
sid: resolved (fixed in 3.6.2+dfsg-2)
trixie: resolved (fixed in 3.6.2+dfsg-2)
Red Hat
Solr: XML eXternal Entity (XXE) flaw in XML and XSLT UpdateRequestHandler
vendor_redhat·2012-09-26·CVSS 7.5
CVE-2012-6612 [HIGH] Solr: XML eXternal Entity (XXE) flaw in XML and XSLT UpdateRequestHandler
Solr: XML eXternal Entity (XXE) flaw in XML and XSLT UpdateRequestHandler
The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407.
Red Hat
Solr: XML eXternal Entity (XXE) flaw in XML and XSLT UpdateRequestHandler
vendor_redhat·2012-09-26·CVSS 6.4
CVE-2013-6407 [MEDIUM] Solr: XML eXternal Entity (XXE) flaw in XML and XSLT UpdateRequestHandler
Solr: XML eXternal Entity (XXE) flaw in XML and XSLT UpdateRequestHandler
The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Debian
CVE-2012-6612: lucene-solr - The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr...
vendor_debian·2012·CVSS 7.5
CVE-2012-6612 [HIGH] CVE-2012-6612: lucene-solr - The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr...
The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407.
Scope: local
bookworm: resolved (fixed in 3.6.2+dfsg-2)
bullseye: resolved (fixed in 3.6.2+dfsg-2)
forky: resolved (fixed in 3.6.2+dfsg-2)
sid: resolved (fixed in 3.6.2+dfsg-2)
trixie: resolved (fixed in 3.6.2+dfsg-2)
No detection rules found.
No public exploits indexed.
http://rhn.redhat.com/errata/RHSA-2013-1844.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0029.htmlhttp://secunia.com/advisories/55542http://secunia.com/advisories/59372http://svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt?view=markuphttp://www.openwall.com/lists/oss-security/2013/11/29/2https://issues.apache.org/jira/browse/SOLR-3895http://rhn.redhat.com/errata/RHSA-2013-1844.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0029.htmlhttp://secunia.com/advisories/55542http://secunia.com/advisories/59372http://svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt?view=markuphttp://www.openwall.com/lists/oss-security/2013/11/29/2https://issues.apache.org/jira/browse/SOLR-3895
2013-12-07
Published