Detections
Analytics

SCA: security update for org.apache.solr:solr-core (GHSA-rc9v-h28f-jcmf)

medium Tenable Self-Hosted Container Security Plugin ID 422806

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity
 expansion (XXE) in Solr config files (solrconfig.xml, schema.xml, managed-schema). In addition, Xinclude
 functionality provided in these config files is also affected in a similar way. The vulnerability can be
 used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or
 the internal network. Users are advised to upgrade to either Solr 6.6.4 or Solr 7.3.1 releases both of
 which address the vulnerability. Once upgrade is complete, no other steps are required. Those releases
 only allow external entities and Xincludes that refer to local files / zookeeper resources below the Solr
 instance directory (using Solr's ResourceLoader); usage of absolute URLs is denied. Keep in mind, that
 external entities and XInclude are explicitly supported to better structure config files in large
 installations. Before Solr 6 this was no problem, as config files were not accessible through the APIs.
 (CVE-2018-8010)

See Also

https://github.com/advisories/GHSA-rc9v-h28f-jcmf

Plugin Details

Severity: Medium

ID: 422806

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 3/29/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2018-8010

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/17/2018

Vulnerability Publication Date: 5/21/2018

Reference Information

CVE: CVE-2018-8010

BID: 104239

cwe: CWE-611