Login Request a demo
Unscored severity · published Dec 7, 2013
CVE-2013-6408
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML…
–
CVSS
11.4%
EPSS
No
On KEV
Description
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
Exploitation
Is it being used?
Exploit prediction (EPSS)11.4% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SO
Solr · Apache
through 4.3.0; 3.6.0; 3.6.1; 3.6.2; 4.0.0; 4.0.0; +4 more · source: NVD
Affected product
SO
Solr
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-6408
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-6408
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-1844.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-0029.html
Vendor Advisory
http://secunia.com/advisories/55542
secunia.com
http://secunia.com/advisories/59372
svn.apache.org
http://svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt?view=markup
www.openwall.com
http://www.openwall.com/lists/oss-security/2013/11/29/2
More from Solr
7.5
CVE-2019-17558
Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability
7.2
CVE-2019-0193
Apache Solr DataImportHandler Code Injection Vulnerability
9.8
CVE-2026-44825
Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
9.8
CVE-2024-45216
Improper Authentication vulnerability in Apache Solr
9.8
CVE-2021-44548
An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from…