CVE-2013-6408
published 2013-12-07CVE-2013-6408: The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an…
PriorityP342medium6.4CVSS 2.0
AVNACLAuNCPINAP
EPSS
11.40%
95.5th percentile
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | solr | <= 4.3.0 | — |
| apache | solr | — | — |
| apache | solr | — | — |
| apache | solr | — | — |
| apache | solr | — | — |
| apache | solr | — | — |
| apache | solr | — | — |
| apache | solr | — | — |
| debian | lucene-solr | < lucene-solr 3.6.2+dfsg-2 (bookworm) | lucene-solr 3.6.2+dfsg-2 (bookworm) |
CVSS provenance
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
ghsa6.4MEDIUM
osv6.4MEDIUM
vendor_debian6.4MEDIUM
vendor_redhat6.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
XML Injection in Apache Solr
ghsa·2022-05-17·CVSS 6.4
CVE-2013-6408 [MEDIUM] CWE-91 XML Injection in Apache Solr
XML Injection in Apache Solr
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
OSV
XML Injection in Apache Solr
osv·2022-05-17·CVSS 6.4
CVE-2013-6408 [MEDIUM] XML Injection in Apache Solr
XML Injection in Apache Solr
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
OSV
CVE-2013-6408: The DocumentAnalysisRequestHandler in Apache Solr before 4
osv·2013-12-07·CVSS 6.4
CVE-2013-6408 [MEDIUM] CVE-2013-6408: The DocumentAnalysisRequestHandler in Apache Solr before 4
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
Red Hat
Solr: XML eXternal Entity (XXE) flaw in DocumentAnalysisRequestHandler
vendor_redhat·2013-05-31·CVSS 6.4
CVE-2013-6408 [MEDIUM] Solr: XML eXternal Entity (XXE) flaw in DocumentAnalysisRequestHandler
Solr: XML eXternal Entity (XXE) flaw in DocumentAnalysisRequestHandler
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
Debian
CVE-2013-6408: lucene-solr - The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly...
vendor_debian·2013·CVSS 6.4
CVE-2013-6408 [MEDIUM] CVE-2013-6408: lucene-solr - The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly...
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
Scope: local
bookworm: resolved (fixed in 3.6.2+dfsg-2)
bullseye: resolved (fixed in 3.6.2+dfsg-2)
forky: resolved (fixed in 3.6.2+dfsg-2)
sid: resolved (fixed in 3.6.2+dfsg-2)
trixie: resolved (fixed in 3.6.2+dfsg-2)
No detection rules found.
No public exploits indexed.
http://rhn.redhat.com/errata/RHSA-2013-1844.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0029.htmlhttp://secunia.com/advisories/55542http://secunia.com/advisories/59372http://svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt?view=markuphttp://www.openwall.com/lists/oss-security/2013/11/29/2https://issues.apache.org/jira/browse/SOLR-4881http://rhn.redhat.com/errata/RHSA-2013-1844.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0029.htmlhttp://secunia.com/advisories/55542http://secunia.com/advisories/59372http://svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt?view=markuphttp://www.openwall.com/lists/oss-security/2013/11/29/2https://issues.apache.org/jira/browse/SOLR-4881
2013-12-07
Published