The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.

The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does incorrectly uses the EmptyEntityResolver, allowing remote, unauthenticated attackers to have allows remote attackers to have an unspecified impact by injecting XML data containing an external entity declaration in conjunction with a valid entity reference, related to an XML External Entity (XXE) issue.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of Apache Solr prior to 5.0 are affected by multiple vulnerabilities :

 - A XXE injection flaw exists in 'UpdateRequestHandler' that is triggered during the parsing of XML data. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can gain access to arbitrary files. (CVE-2012-6612, CVE-2013-6407)
 - A XXE injection flaw in 'DocumentAnalysisRequestHandler' exists that is triggered during the parsing of XML data. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can gain access to arbitrary files. (CVE-2013-6408)

Multiple vulnerabilities were found in Solr, an open source enterprise search server based on Lucene, resulting in information disclosure or code execution.

The version of Apache Solr running on the remote web server is affected by an XML external entity injection vulnerability due to an incorrectly configured XML parser in the 'DocumentAnalysisRequestHandler' class.  A remote, unauthenticated attacker can exploit this flaw to gain access to arbitrary files or to cause a denial of service condition.

Note that this issue exists due to an incomplete fix for CVE-2013-6407.

ID	Name	Product	Family	Severity
98889	Apache Solr 3.6.0 < 4.3.1 XML External Entity	Web App Scanning	Component Vulnerability	medium
9943	Apache Solr < 5.0 Multiple XXE	Nessus Network Monitor	CGI	medium
76091	Debian DSA-2963-1 : lucene-solr - security update	Nessus	Debian Local Security Checks	medium
71845	Apache Solr < 4.3.1 XML External Entity Injection	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2013-6408

medium

Tenable Plugins

medium

medium

medium

medium