NetSight
IP …
high7.5

CVE-2018-1308

This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter …

Impact

This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.

Affected products

VendorProductAffected versions
ApacheSolr
from 1.2 through 6.6.2
from 7.0.0 through 7.2.1
DebianDebian Linux
Versions 7.0, 8.0, 9.0

Weakness classification

CWE-611

References