CVE-2013-6397

None

CVSS

—

EPSS

56.3%

Published

Dec 7, 2013

CISA due date

—

The record

Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.

Affected packages

Ecosystem	Package	Fixed
Maven	org.apache.solr:solr-core	4.6.0
Debian:11	lucene-solr	3.6.2+dfsg-2
Debian:12	lucene-solr	3.6.2+dfsg-2
Debian:13	lucene-solr	3.6.2+dfsg-2
Debian:7	lucene-solr	3.6.0+dfsg-1+deb7u1
Ubuntu:14.04:LTS	lucene-solr	3.6.2+dfsg-2
Ubuntu:16.04:LTS	lucene-solr	3.6.2+dfsg-8

Related vulnerabilities

CVE-2026-22022 Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the… Also affects org.apache.solr:solr-core
CVE-2026-22444 Apache Solr: Insufficient file-access checking in standalone core-creation requests Also affects org.apache.solr:solr-core
CVE-2024-52012 Apache Solr Relative Path Traversal vulnerability Also affects org.apache.solr:solr-core
CVE-2023-50290 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. Also affects org.apache.solr:solr-core
CVE-2017-12629 Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by… Also affects org.apache.solr:solr-core
CVE-2012-6612 The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before… Also affects org.apache.solr:solr-core
CVE-2013-6407 The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to… Also affects org.apache.solr:solr-core
CVE-2013-6408 The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the… Also affects org.apache.solr:solr-core