Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers
    to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the
    response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML
    eXternal Entity) vulnerability to allow access to files across restricted network boundaries.
    (CVE-2013-6397)

Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6.0 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname due to insufficient validation in the tr parameter.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of Apache Solr prior to 4.6.0 are affected by a flaw in the 'SolrResourceLoader' class that leads to unauthorized privileges being gained. The issue is due to the program failing to restrict the loading of specially crafted XLS stylesheets or Velocity templates via the absolute path or a traversal attack. This may allow a remote attacker to gain elevated privileges.

Multiple vulnerabilities were found in Solr, an open source enterprise search server based on Lucene, resulting in information disclosure or code execution.

The version of Apache Solr running on the remote web server is affected by a directory traversal vulnerability because the 'SolrResourceLoader' class fails to restrict access to the loading of specially crafted XLS stylesheets and velocity templates. A remote, unauthenticated attacker can exploit this issue by crafting a URL with directory traversal characters to access resources outside of the instance directory.

ID	Name	Product	Family	Severity
416253	SCA: security update for org.apache.solr:solr-core (GHSA-j8qw-mwmv-28cg)	Tenable Cloud Security	SCA Checks	medium
416253	SCA: security update for org.apache.solr:solr-core (GHSA-j8qw-mwmv-28cg)	Tenable Self-Hosted Container Security	SCA Checks	medium
98887	Apache Solr 4.0.0 < 4.6.0 Directory Traversal	Web App Scanning	Component Vulnerability	medium
9944	Apache Solr < 4.6.0 Directory Traversal	Nessus Network Monitor	CGI	medium
76091	Debian DSA-2963-1 : lucene-solr - security update	Nessus	Debian Local Security Checks	medium
71846	Apache Solr < 4.6.0 'SolrResourceLoader' Directory Traversal	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2013-6397

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium