Apache Solr UpdateRequestHandler for XML resolves XML External Entities

MEDIUM 6.4CVE-2013-6407 · GHSA-998j-j6v9-5846 · Published 07/12/2013 · updated 17/06/2026

Package	Affected versions	Patched versions
org.apache.solr:solr-core Maven	`< 4.1.0`	`4.1.0`
solr apache	`= 3.6.0= 3.6.1= 3.6.2= 4.0.0≤ 4.0.0`	No fix yet

Description

The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2013-6407 · ADVISORY
apache/lucene-solr commit f230486 · WEB
apache/lucene-solr · PACKAGE
issues.apache.org/jira/browse/SOLR-3895 · WEB
rhn.redhat.com/errata/RHSA-2013-1844.html · WEB
rhn.redhat.com/errata/RHSA-2014-0029.html · WEB
secunia.com/advisories/55542 · WEB
secunia.com/advisories/59372 · WEB
svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt · WEB
openwall.com/lists/oss-security/2013/11/29/2 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free