PT-2018-11581 · Apache · Apache Solr

麦 香浓郁 · Published 2018-04-09 · Updated 2019-11-12 · CVE-2018-1308

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Solr versions 1.2 through 6.6.2 Apache Solr versions 7.0.0 through 7.2.1

Description The issue relates to an XML external entity expansion (XXE) in the &dataConfig=<inlinexml> parameter of Solr's DataImportHandler. This can be exploited to read arbitrary local files from the Solr server or the internal network using file, ftp, or http protocols.

Recommendations For Apache Solr versions 1.2 through 6.6.2, avoid using the &dataConfig=<inlinexml> parameter in the DataImportHandler until a patch is available. For Apache Solr versions 7.0.0 through 7.2.1, consider restricting access to the DataImportHandler to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-1308

DLA-1360-1

DSA-4194-1

GHSA-3PPH-2595-CGFH

Affected Products

Apache Solr

References · 24

• https://security-tracker.debian.org/tracker/source-package/lucene-solr · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4194-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1308 · Security Note
• https://debian.org/security/2018/dsa-4194 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1308 · Security Note
• https://ubuntu.com/security/CVE-2018-1308 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1308 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-1308 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3pph-2595-cgfh · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1308 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1308 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-4194-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1308 · Vendor Advisory
• https://github.com/apache/lucene-solr/commit/3530397f1777332872eac2760f9aa0e2ae1d7450 · Note
• https://github.com/apache/lucene-solr/commit/739a7933 · Note