Improper Restriction of XML External Entity Reference in Apache Solr

HIGH 7.5CVE-2012-6612 · GHSA-6cpj-3g83-q2j4 · Published 07/12/2013 · updated 16/06/2026

Package	Affected versions	Patched versions
org.apache.solr:solr-core Maven	`< 4.1.0`	`4.1.0`
solr apache	`= 4.0.0≤ 4.0.0`	No fix yet

Description

The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2012-6612 · ADVISORY
apache/lucene-solr commit 0d21b90 · WEB
apache/lucene-solr commit f230486 · WEB
apache/lucene-solr · PACKAGE
issues.apache.org/jira/browse/SOLR-3895 · WEB
rhn.redhat.com/errata/RHSA-2013-1844.html · WEB
rhn.redhat.com/errata/RHSA-2014-0029.html · WEB
svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free