XML External Entity (XXE)

Apache Solr is vulnerable to XML External Entity XXE attacks. The library uses an insecure DocumentBuilderFactory class is to parse the currency.xml and enumsConfig.xml files. This can allow a malicious user with access to these files to conduct an XXE attack to reveal sensitive information...

CVE-2018-8026: Improper Restriction of XML External Entity Reference

This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion XXE in Solr config files currency.xml, enumsConfig.xml referred from schema.xml, TIKA parsecontext config file. In addition, Xinclude functionality provided in these config files is als...