CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
84.5%
This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates
to an XML external entity expansion (XXE) in Solr config files
(currency.xml, enumsConfig.xml referred from schema.xml, TIKA parsecontext
config file). In addition, Xinclude functionality provided in these config
files is also affected in a similar way. The vulnerability can be used as
XXE using file/ftp/http protocols in order to read arbitrary local files
from the Solr server or the internal network. The manipulated files can be
uploaded as configsets using Solr’s API, allowing to exploit that
vulnerability.
issues.apache.org/jira/browse/SOLR-12450
launchpad.net/bugs/cve/CVE-2018-8026
mail-archives.apache.org/mod_mbox/lucene-solr-user/201807.mbox/%3C0cdc01d413b7%24f97ba580%24ec72f080%24%40apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2018-8026
security-tracker.debian.org/tracker/CVE-2018-8026
www.cve.org/CVERecord?id=CVE-2018-8026
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
84.5%