GHSA-3pph-2595-cgfh CVE-2018-1308

There is a XML external entity expansion (XXE) vulnerability in Apache Solr

High Maven

Severity: 7.5 / 10; High · CVSS 3.0
Exploit chance (EPSS): 20.82%; Chance of exploitation in the next 30 days. Higher than 97.55% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-611 Improper Restriction of XML External Entity Reference
Fix: 6.6.3; Upgrade org.apache.solr:solr-core to this version or later

Description

This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the &dataConfig=<inlinexml> parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.

Affected versions

Maven

Package	Vulnerable	Fixed in
org.apache.solr:solr-core	`>= 1.2, < 6.6.3`	`6.6.3`
org.apache.solr:solr-core	`>= 7.0.0, < 7.3.0`	`7.3.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.apache.solr:solr-core Maven → `6.6.3`

maven

<dependency><groupId>org.apache.solr</groupId><artifactId>solr-core</artifactId><version>6.6.3</version></dependency>

gradle

implementation("org.apache.solr:solr-core:6.6.3")

Severity breakdown

CVSS 3.0 7.5

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Weakness

CWE-611: Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

How to prevent it

Implementation, System Configuration: Many XML parsers and validators can be configured to disable external entity expansion.

References

Advisories

Timeline

Oct 17, 2018 Published
Mar 4, 2024 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
CVE-2019-17558 Improper Input Validation in Apache Solr	High Known exploited	Also affects org.apache.solr:solr-core
CVE-2019-0193 XML External Entity (XXE) Injection in Apache Solr	High Known exploited	Also affects org.apache.solr:solr-core
GHSA-qhr7-h655-pw6r Apache Solr has hardcoded credentials in the Basic Authentication setup tool	Critical	Also affects org.apache.solr:solr-core
GHSA-vc2w-4v3p-2mqw Apache Solr: Insufficient file-access checking in standalone core-creation requests	High	Also affects org.apache.solr:solr-core
GHSA-qr3p-2xj2-q7hq Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin	High	Also affects org.apache.solr:solr-core
GHSA-68r2-fwcg-qpm8 Apache Solr vulnerable to Execution with Unnecessary Privileges	Medium	Also affects org.apache.solr:solr-core
GHSA-4p5m-gvpf-f3x5 Apache Solr Relative Path Traversal vulnerability	Medium	Also affects org.apache.solr:solr-core
GHSA-37vr-vmg4-jwpw Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets	High	Also affects org.apache.solr:solr-core

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor