Apache Solr < 5.3.1 Cross-Site Scripting

Cross-site scripting XSS vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr versions 5.3.1 allows for remote attackers to inject arbitrary web script or HTML via the entry parameter to a plugins/cache URI. Note that the scanner has not tested for...

Apache Solr 1.2.0 < 6.6.2 XML Entity Expansion

This vulnerability in Apache Solr 1.2 parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server. Note that the scanner has not tested for these issues but has instead relied only on the application's...

Apache Solr 5.0.0 < 5.5.5 Remote Code Execution

In Apache Solr versions 5.0.0 5.5.5 and 6.0.0 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker may take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side. Note that t...

Apache Solr 3.6.0 < 4.1.0 XML External Entity

Apache Solr versions 3.6.0 4.1.0 allows remote attackers to have an unspecified impact via the 'UpdateRequestHandler' by injecting XML data containing an external entity declaration in conjunction with a valid entity reference, related to an XML External Entity XXE issue Note that the scanner has...

Apache Solr 1.3.0 < 1.4.1 XML Resource Consumption Attack

Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack via its update handle; leveraging XML DOCTYPE and ENTITY type elements, a remote, unauthenticated attacker may write data to the server which will expand when the server parses th...

Apache Solr 4.0.0 < 4.10.3 Cross-Site Scripting

Cross-site scripting XSS vulnerability in the Admin UI Plugin / Stats page in Apache Solr versions 4.x 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the fieldvaluecache object. Note that the scanner has not tested for these issues but has instead relied only on the...

Apache Solr 6.0.0 < 6.6.5 Remote Code Execution

In Apache Solr versions 5.0.0 5.5.5 and 6.0.0 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker may take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side. Note that t...

Apache Solr 7.0.0 < 7.2.1 XML Entity Expansion

This vulnerability in Apache Solr 1.2 parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server. Note that the scanner has not tested for these issues but has instead relied only on the application's...

Apache Solr < 5.3.0 Cross-Site Scripting

Cross-site scripting XSS vulnerability in webapp/web/js/scripts/schema-browser.js in the Admin UI in Apache Solr 5.3.0 allows remote attackers to inject arbitrary web script or HTML via a maliciously crafted URL. Note that the scanner has not tested for these issues but has instead relied only on...

VulnCheck KEV: CVE-2019-0193

The optional Apache Solr module DataImportHandler contains a code injection vulnerability...

CVE-2019-17558

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...

Apache Solr < 8.4.0 Remote Code Execution

The version of Apache Solr running on the remote host is at least 5.0.0 and prior to 8.4.0. It is, therefore, affected by a remote code execution vulnerability. A remote code execution vulnerability exists in VelocityResponseWriter due to a flaw in the velocity template parameter. An...

Apache Solr Code Injection Vulnerability

Apache Solr is the United States Apache Apache Software Foundation of a Lucene a full-text search engine based on the search server . The product supports level search , vertical search , highlighting search results and so on. A code injection vulnerability exists in Apache Solr versions 5.0.0...

CVE-2019-17558

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...

CVE-2019-17558

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...

Remote code execution

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...

CVE-2019-17558

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...

CVE-2019-17558

CVE-2019-17558 affects Apache Solr 5.0.0–8.3.1 and allows remote code execution via the VelocityResponseWriter. An attacker can supply a Velocity template through configset velocity/ or via a parameter; enabling the resource loader for templates requires a configured response writer. Solr 8.4 rem...

CVE-2019-17558

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...

CVE-2019-17558

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...