Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML causing OOMs.

Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack via its update handle; leveraging XML DOCTYPE and ENTITY type elements, a remote, unauthenticated attacker may write data to the server which will expand when the server parses the XML, causing out of memory issues.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
98918	Apache Solr 4.0.0 < 4.10.4 XML Resource Consumption Attack	Web App Scanning	Component Vulnerability	high
98899	Apache Solr 3.1.0 < 3.6.2 XML Resource Consumption Attack	Web App Scanning	Component Vulnerability	high
98898	Apache Solr 1.3.0 < 1.4.1 XML Resource Consumption Attack	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2019-12401

high

Tenable Plugins

high

high

high