6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
0.003 Low
EPSS
Percentile
70.9%
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
rhn.redhat.com/errata/RHSA-2013-1844.html
rhn.redhat.com/errata/RHSA-2014-0029.html
svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt?view=markup
www.openwall.com/lists/oss-security/2013/11/29/2
github.com/apache/lucene-solr
github.com/apache/lucene-solr/commit/7239a57a51ea0f4d05dd330ce5e15e4f72f72747
issues.apache.org/jira/browse/SOLR-4881
nvd.nist.gov/vuln/detail/CVE-2013-6408