Unscored severity · published Dec 7, 2013
CVE-2012-6612
The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an…
–
CVSS
10.1%
EPSS
No
On KEV
Description
The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407.
Exploitation
Is it being used?
Exploit prediction (EPSS)10.1% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SO
Solr · Apache
through 4.0.0; 4.0.0; 4.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-6612
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-6612
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-1844.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-0029.html
svn.apache.org
http://svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt?view=markup
Patch
https://issues.apache.org/jira/browse/SOLR-3895
More from Solr
7.5
CVE-2019-17558
Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability
7.2
CVE-2019-0193
Apache Solr DataImportHandler Code Injection Vulnerability
9.8
CVE-2026-44825
Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
9.8
CVE-2024-45216
Improper Authentication vulnerability in Apache Solr
9.8
CVE-2021-44548
An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from…