| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.solr:solr-core | ≥ 1.2, < 6.6.3≥ 7.0.0, < 7.3.0 | 6.6.37.3.0 |
| solr | ≥ 1.2, ≤ 6.6.2≥ 7.0.0, ≤ 7.2.1 |
This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the &dataConfig=<inlinexml> parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free