| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.solr:solr-core | < 4.6.0 | 4.6.0 |
| solr | = 4.0.0= 4.1.0= 4.2.0= 4.2.1= 4.3.0= 4.3.1= 4.4.0= 4.5.0≤ 4.5.1 |
Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free