CVSS: 4.3EPSS: 2%CPEs: 23EXPL: 0CVE-2014-3628
https://notcve.org/view.php?id=CVE-2014-3628
Cross-site scripting (XSS) vulnerability in the Admin UI Plugin / Stats page in Apache Solr 4.x before 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the fieldvaluecache object. Vulnerabilidad de XSS en la página Admin UI Plugin / Stats en Apache Solr 4.x anterior a 4.10.3 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del objeto fieldvaluecache. • http://mail-archives.us.apache.org/mod_mbox/www-announce/201412.mbox/%3C54A1A7C7.2070804%40apache.org%3E http://secunia.com/advisories/62024 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 52%CPEs: 11EXPL: 1CVE-2013-6397 – Solr: directory traversal when loading XSL stylesheets and Velocity templates
https://notcve.org/view.php?id=CVE-2013-6397
Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries. Vulnerabilidad de salto de directorio en SolrResourceLoader en Apache Solr anteriores a 4.6 permite a atacantes remotos leer ficheros arbitrarios a través de un .. (punto puno) o nombre de directorio completo en el parámetro tr de solr/select/, cuando el escritor de respuesta (parámetro wt) se establece a XLST. • http://lucene.apache.org/solr/4_6_0/changes/Changes.html http://rhn.redhat.com/errata/RHSA-2013-1844.html http://rhn.redhat.com/errata/RHSA-2014-0029.html http://secunia.com/advisories/55730 http://secunia.com/advisories/59372 http://www.agarri.fr/kom/archives/2013/11/27/compromising_an_unreachable_solr_server_with_cve-2013-6397/index.html http://www.openwall.com/lists/oss-security/2013/11/27/1 http://www.securityfocus.com/bid/63935 https://issues.apache.org/ • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.4EPSS: 0%CPEs: 10EXPL: 0CVE-2013-6408 – Solr: XML eXternal Entity (XXE) flaw in DocumentAnalysisRequestHandler
https://notcve.org/view.php?id=CVE-2013-6408
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407. El DocumentAnalysisRequestHandler en Apache Solr anteriores a 4.3.1 no utiliza correctamente el EmptyEntityResolver, lo cual permite a atacantes remotos tener un impacto no especificado a través de datos XML conteniendo una declaración de entidad externa en conjunción con una referencia a entidad, relacionado con un problema XML External Entity (XXE). NOTA: esta vulnerabilidad existe debido a una solución incompleta de CVE-2013-6407. • http://rhn.redhat.com/errata/RHSA-2013-1844.html http://rhn.redhat.com/errata/RHSA-2014-0029.html http://secunia.com/advisories/55542 http://secunia.com/advisories/59372 http://svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt?view=markup http://www.openwall.com/lists/oss-security/2013/11/29/2 https://issues.apache.org/jira/browse/SOLR-4881 https://access.redhat.com/security/cve/CVE-2013-6408 https://bugzilla.redhat.com/show_bug.cgi?id=1035985 •