Apache Solr 5.3.x 'XMLResponseParser.java' XXE

high Nessus Network Monitor Plugin ID 9072

Synopsis

The remote web server contains a Java application that is affected by an XXE injection vulnerability.

Description

Versions of Apache Solr 5.3.x are affected by an XXE (Xml eXternal Entity) injection flaw that is triggered during the parsing of XML data passed via the 'stream.body' parameter in 'XMLResponseParser.java'. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can have an unspecified impact.

Solution

Upgrade to Solr 5.4.0 or later.

Plugin Details

Severity: High

ID: 9072

Family: CGI

Published: 2/5/2016

Updated: 3/6/2019

Vulnerability Information

CPE: cpe:/a:apache:solr

Patch Publication Date: 1/23/2016

Vulnerability Publication Date: 11/17/2015

Detections

Analytics