CVE-2013-6407
NoneCVSS
—
EPSS
11.4%
Published
Dec 7, 2013
CISA due date
—
The record
The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.solr:solr-core | 0 | 4.1.0 |
| Debian:11 | lucene-solr | 0 | 3.6.2+dfsg-2 |
| Debian:12 | lucene-solr | 0 | 3.6.2+dfsg-2 |
| Debian:13 | lucene-solr | 0 | 3.6.2+dfsg-2 |
| Debian:7 | lucene-solr | 0 | 3.6.0+dfsg-1+deb7u1 |
| Ubuntu:14.04:LTS | lucene-solr | 0 | 3.6.2+dfsg-2 |
| Ubuntu:16.04:LTS | lucene-solr | 0 | 3.6.2+dfsg-8 |
Related vulnerabilities
- CVE-2026-22022 Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the… Also affects org.apache.solr:solr-core
- CVE-2026-22444 Apache Solr: Insufficient file-access checking in standalone core-creation requests Also affects org.apache.solr:solr-core
- CVE-2024-52012 Apache Solr Relative Path Traversal vulnerability Also affects org.apache.solr:solr-core
- CVE-2023-50290 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. Also affects org.apache.solr:solr-core
- CVE-2017-12629 Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by… Also affects org.apache.solr:solr-core
- CVE-2012-6612 The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before… Also affects org.apache.solr:solr-core
- CVE-2013-6408 The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the… Also affects org.apache.solr:solr-core
- CVE-2013-6397 Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows… Also affects org.apache.solr:solr-core