Lucene search
PRIOn knowledge basePRION:CVE-2018-1308HistoryApr 09, 2018 - 1:29 p.m.
Xxe
2018-04-0913:29:00
PRIOn knowledge base
www.prio-n.com
3
This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the &dataConfig=<inlinexml> parameter of Solr’s DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.
| CPE | Name | Operator | Version |
|---|---|---|---|
| solr | ge | 7.0.0 | |
| solr | le | 7.2.1 | |
| solr | ge | 1.2 | |
| solr | le | 6.6.2 | |
| debian_linux | eq | 8.0 | |
| debian_linux | eq | 7.0 | |
| debian_linux | eq | 9.0 |
References
issues.apache.org/jira/browse/SOLR-11971
lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E
lists.debian.org/debian-lts-announce/2018/04/msg00025.html
mail-archives.apache.org/mod_mbox/www-announce/201804.mbox/%3C000001d3cf68%245ac69af0%241053d0d0%24%40apache.org%3E
www.debian.org/security/2018/dsa-4194
Related
openvas
openvas
Debian: Security Advisory (DLA-1360-1)
2018-04-24 00:00:00
Apache Solr XXE Vulnerability (SOLR-11971) - Windows
2018-04-09 00:00:00
Debian: Security Advisory (DSA-4194-1)
2018-05-05 00:00:00
checkpoint_advisories
checkpoint_advisories
debian
debian
[SECURITY] [DSA 4194-1] lucene-solr security update
2018-05-06 17:43:51
[SECURITY] [DLA 1360-1] lucene-solr security update
2018-04-24 17:57:05
redhatcve
redhatcve
CVE-2018-1308
2018-04-09 03:48:54
ubuntucve
ubuntucve
CVE-2018-1308
2018-04-09 00:00:00
veracode
veracode
XML External Entity (XXE)
2018-04-09 06:59:14
github
github
There is a XML external entity expansion (XXE) vulnerability in Apache Solr
2018-10-17 19:55:46
osv
osv
There is a XML external entity expansion (XXE) vulnerability in Apache Solr
2018-10-17 19:55:46
CVE-2018-1308
2018-04-09 13:29:00
lucene-solr - security update
2018-04-24 00:00:00
nvd
nvd
CVE-2018-1308
2018-04-09 13:29:00
cve
cve
CVE-2018-1308
2018-04-09 13:29:00
nessus
nessus
Debian DLA-1360-1 : lucene-solr security update
2018-04-25 00:00:00
Debian DSA-4194-1 : lucene-solr - security update
2018-05-07 00:00:00
debiancve
debiancve
CVE-2018-1308
2018-04-09 13:29:00
cvelist
cvelist
CVE-2018-1308
2018-04-08 00:00:00
