Improper Restriction of XML External Entity Reference in Apache Solr
Date: 2022-05
Affected: maven/org.apache.solr:solr-core
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2012-6612
CVE-2013-6397
CVE-2013-6407
CVE-2013-6408
CWE: CWE-22
CWE-611
CWE-91

The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407.


Mitigations:

Architectural layers (MAESTRO):