Improper Neutralization of Input During Web Page Generation in Apache Solr

2022-05-1703:58:49

Google

osv.dev

0.037 Low

EPSS

Percentile

91.8%

JSON

Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via the entry parameter to a plugins/cache URI.

CPENameOperatorVersion
org.apache.solr:solr-coreeq4.5.0
org.apache.solr:solr-coreeq4.0.0
org.apache.solr:solr-coreeq4.6.1
org.apache.solr:solr-coreeq3.6.1
org.apache.solr:solr-coreeq4.8.1
org.apache.solr:solr-coreeq4.10.2
org.apache.solr:solr-coreeq4.0.0-ALPHA
org.apache.solr:solr-coreeq4.7.0
org.apache.solr:solr-coreeq4.10.3
org.apache.solr:solr-coreeq1.3.0

Name	Operator	Version
org.apache.solr:solr-core	eq	4.5.0
org.apache.solr:solr-core	eq	4.0.0
org.apache.solr:solr-core	eq	4.6.1
org.apache.solr:solr-core	eq	3.6.1
org.apache.solr:solr-core	eq	4.8.1
org.apache.solr:solr-core	eq	4.10.2
org.apache.solr:solr-core	eq	4.0.0-ALPHA
org.apache.solr:solr-core	eq	4.7.0
org.apache.solr:solr-core	eq	4.10.3
org.apache.solr:solr-core	eq	1.3.0