Detections
Analytics
Apache Solr < 4.1.0 Multiple XML External Entity Injections
high Nessus Plugin ID 71844
Language:
Synopsis
The remote web server contains a Java application that is affected by multiple XML External Entity (XXE) injection vulnerabilities.Description
The version of Apache Solr running on the remote web server is affected by multiple XML external entity injection vulnerabilities because the XML parser accepts XML data containing external entity declarations from untrusted sources. A remote, unauthenticated attacker can exploit this flaw to gain access to arbitrary files or to cause a denial of service condition.Solution
Upgrade to Apache Solr version 4.1.0 or later.See Also
Plugin Details
Severity: High
ID: 71844
File Name: solr_4_1_0.nasl
Version: 1.5
Type: remote
Family: CGI abuses
Published: 1/7/2014
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:apache:solr
Required KB Items: installed_sw/Apache Solr
Exploit Ease: No exploit is required
Patch Publication Date: 9/27/2012
Vulnerability Publication Date: 9/26/2012
Reference Information
CVE: CVE-2012-6612, CVE-2013-6407