Lucene search

ApacheCVE-2018-8026

HistoryJul 05, 2018 - 2:29 p.m.

CVE-2018-8026

2018-07-0514:29:00

CWE-611

apache

web.nvd.nist.gov

cve-2018-8026

xxe

apache solr

vulnerability

config files

solr server

api

security

nvd

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.011

Percentile

84.5%

JSON

This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files (currency.xml, enumsConfig.xml referred from schema.xml, TIKA parsecontext config file). In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerability can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network. The manipulated files can be uploaded as configsets using Solr’s API, allowing to exploit that vulnerability.

Affected configurations

Nvd

Vulners

Node

apachesolrRange6.0.0–6.6.4

apachesolrRange7.0.0–7.3.1

Node

netappsnapcenterMatch-

netappstorage_automation_storeMatch-

VendorProductVersionCPE
apachesolr*cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*
netappsnapcenter-cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
netappstorage_automation_store-cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	solr	*	cpe:2.3:a:apache:solr::::::::
netapp	snapcenter	-	cpe:2.3:a:netapp:snapcenter:-:::::::*
netapp	storage_automation_store	-	cpe:2.3:a:netapp:storage_automation_store:-:::::::*

CNA Affected

[
  {
    "product": "Apache Solr",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "6.0.0 to 6.6.4"
      },
      {
        "status": "affected",
        "version": "7.0.0 to 7.3.1"
      }
    ]
  }
]