CVE-2013-6408
NoneCVSS
—
EPSS
11.4%
Published
Dec 7, 2013
CISA due date
—
The record
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.solr:solr-core | 0 | 4.3.1 |
| Debian:11 | lucene-solr | 0 | 3.6.2+dfsg-2 |
| Debian:12 | lucene-solr | 0 | 3.6.2+dfsg-2 |
| Debian:13 | lucene-solr | 0 | 3.6.2+dfsg-2 |
| Debian:7 | lucene-solr | 0 | 3.6.0+dfsg-1+deb7u1 |
| Ubuntu:14.04:LTS | lucene-solr | 0 | 3.6.2+dfsg-2 |
| Ubuntu:16.04:LTS | lucene-solr | 0 | 3.6.2+dfsg-8 |
Related vulnerabilities
- CVE-2026-22022 Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the… Also affects org.apache.solr:solr-core
- CVE-2026-22444 Apache Solr: Insufficient file-access checking in standalone core-creation requests Also affects org.apache.solr:solr-core
- CVE-2024-52012 Apache Solr Relative Path Traversal vulnerability Also affects org.apache.solr:solr-core
- CVE-2023-50290 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. Also affects org.apache.solr:solr-core
- CVE-2017-12629 Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by… Also affects org.apache.solr:solr-core
- CVE-2012-6612 The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before… Also affects org.apache.solr:solr-core
- CVE-2013-6407 The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to… Also affects org.apache.solr:solr-core
- CVE-2013-6397 Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows… Also affects org.apache.solr:solr-core