Apache Solr 3.6.0 < 4.3.1 XML External Entity

The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does incorrectly uses the EmptyEntityResolver, allowing remote, unauthenticated attackers to have allows remote attackers to have an unspecified impact by injecting XML data containing an external entity declaration in conjunction wit...

Apache Solr < 5.3.1 Cross-Site Scripting

Cross-site scripting XSS vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr versions 5.3.1 allows for remote attackers to inject arbitrary web script or HTML via the entry parameter to a plugins/cache URI. Note that the scanner has not tested for...

Apache Solr 1.2.0 < 6.6.2 XML Entity Expansion

This vulnerability in Apache Solr 1.2 parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server. Note that the scanner has not tested for these issues but has instead relied only on the application's...

Apache Solr < 5.3.0 Cross-Site Scripting

Cross-site scripting XSS vulnerability in webapp/web/js/scripts/schema-browser.js in the Admin UI in Apache Solr 5.3.0 allows remote attackers to inject arbitrary web script or HTML via a maliciously crafted URL. Note that the scanner has not tested for these issues but has instead relied only on...

Apache Solr 1.3.0 <= 7.6.0 Server Side Request Forgery

Server Side Request Forgery in Apache Solr, versions 1.3.0 until 7.6.0 inclusive. A remote, unauthenticated attacker can use the 'shards' parameter to make a HTTP GET request to any reachable web server; as this does not use any applicable whitelist or URL validation. Note that the scanner has no...

Apache Solr 6.0.0 < 6.6.5 Remote Code Execution

In Apache Solr versions 5.0.0 5.5.5 and 6.0.0 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker may take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side. Note that t...

Apache Solr 7.0.0 < 7.2.1 XML Entity Expansion

This vulnerability in Apache Solr 1.2 parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server. Note that the scanner has not tested for these issues but has instead relied only on the application's...

Apache Solr 4.0.0 < 4.10.4 XML Resource Consumption Attack

Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack via its update handle; leveraging XML DOCTYPE and ENTITY type elements, a remote, unauthenticated attacker may write data to the server which will expand when the server parses th...

Apache Solr < 5.5.4 Directory Traversal

When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. Solr versions 5.5.4 and 6.x 6.4.1 do not validate this file name allowing for a remote, unauthenticated attacker to access any files readable by...

Apache Solr < 5.1.0 Cross-Site Scripting

Multiple cross-site scripting XSS vulnerabilities in the Admin UI in Apache Solr versions 5.1.0 allow remote attackers to inject arbitrary web script or HTML via crafted fields due to insufficient input validation utilized by webapp/web/js/scripts/analysis.js and...

Apache Solr 4.0.0 < 4.10.3 Cross-Site Scripting

Cross-site scripting XSS vulnerability in the Admin UI Plugin / Stats page in Apache Solr versions 4.x 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the fieldvaluecache object. Note that the scanner has not tested for these issues but has instead relied only on the...

Apache Solr 6.x < 6.4.1 Directory Traversal

When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. Solr versions 5.5.4 and 6.x 6.4.1 do not validate this file name allowing for a remote, unauthenticated attacker to access any files readable by...

Apache Solr < 7.1.0 Remote Code Execution

Remote code execution occurs in Apache Solr versions 7.1.0 with Apache Lucene 7.1.0 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. This can be exploited to upload malicious data to the /upload request handler or as Blind XX...

Apache Solr 4.0.0 XML External Entity

Apache Solr 4.0.0 allows remote attackers to have an unspecified impact via the 'UpdateRequestHandler' for XSLT or 'XPathEntityProcessor', by injecting XML data containing an external entity declaration in conjunction with a valid entity reference, related to an XML External Entity XXE issue. Not...

Apache Solr 3.6.0 < 4.1.0 XML External Entity

Apache Solr versions 3.6.0 4.1.0 allows remote attackers to have an unspecified impact via the 'UpdateRequestHandler' by injecting XML data containing an external entity declaration in conjunction with a valid entity reference, related to an XML External Entity XXE issue Note that the scanner has...

Apache Solr 4.0.0 < 4.6.0 Directory Traversal

Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6.0 allows remote attackers to read arbitrary files via a .. dot dot or full pathname due to insufficient validation in the tr parameter. Note that the scanner has not tested for these issues but has instead relied on...

VulnCheck KEV: CVE-2019-0193

The optional Apache Solr module DataImportHandler contains a code injection vulnerability...

CVE-2019-12401

Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack a.k.a. Lol Bomb via it’s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML...

CVE-2019-17558

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...

Apache Solr < 8.4.0 Remote Code Execution

The version of Apache Solr running on the remote host is at least 5.0.0 and prior to 8.4.0. It is, therefore, affected by a remote code execution vulnerability. A remote code execution vulnerability exists in VelocityResponseWriter due to a flaw in the velocity template parameter. An...