Solr: Code execution via entity expansion

🗓️ 16 Nov 2017 19:52:09Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 1 Views

Solr code execution via entity expansion from unauthenticated input enables arbitrary code.

Reporter	Title	Published	Views	Family All 109
Gitee	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat	16 May 202116:14	–	gitee
Gitee	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat	27 Apr 202114:33	–	gitee
Gitee	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat	22 Oct 202115:45	–	gitee
Gitee	Exploit for Improper Restriction of XML External Entity Reference in Apache Solr	7 Mar 202111:09	–	gitee
Gitee	Exploit for OS Command Injection in Gnu Bash	27 Jul 202504:21	–	gitee
Gitee	Exploit for Improper Restriction of XML External Entity Reference in Apache Solr	16 Aug 202116:49	–	gitee
0day.today	Apache Solr 7.0.1 - XML External Entity Expansion / Remote Code Execution Vulnerability	18 Oct 201700:00	–	zdt
IBM Security Bulletins	Security Bulletin: A vulnerability in Apache Solr affects IBM InfoSphere Information Server	3 Apr 201923:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere BigInsights 4.2.5 is affected by an Open Source (Solr) vulnerabilty (CVE-2017-12629)	18 Jul 202023:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 8.0.2	18 Jun 202414:02	–	ibm

Vulners

Node

redhat jboss_data_gridRange<7.1

AND

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2017-12629
access	www.access.redhat.com/security/vulnerabilities/CVE-2017-12629
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2017-12629
cve	www.cve.org/CVERecord

28 May 2026 20:35Current

7.6High risk

Vulners AI Score7.6

CVSS 27.5

CVSS 3.19.8

EPSS0.91896

Solr entity expansion unauthenticated input arbitrary code execution configuration API