There is a XML external entity expansion (XXE) vulnerability in Apache Solr

HIGH 7.5CVE-2018-1308 · GHSA-3pph-2595-cgfh · Published 09/04/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
org.apache.solr:solr-core Maven	`≥ 1.2, < 6.6.3≥ 7.0.0, < 7.3.0`	`6.6.37.3.0`
solr apache	`≥ 1.2, ≤ 6.6.2≥ 7.0.0, ≤ 7.2.1`	No fix yet

Description

This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the &dataConfig=<inlinexml> parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.

NVD description

This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free