Apache Solr 5.3.x 'XMLResponseParser.java' XXE

High Nessus Network Monitor Plugin ID 9072

Synopsis

The remote web server contains a Java application that is affected by an XXE injection vulnerability.

Description

Versions of Apache Solr 5.3.x are affected by an XXE (Xml eXternal Entity) injection flaw that is triggered during the parsing of XML data passed via the 'stream.body' parameter in 'XMLResponseParser.java'. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can have an unspecified impact.

Solution

Upgrade to Solr 5.4.0 or later.

See Also

http://lucene.apache.org/solr/5_4_0/changes

https://issues.apache.org/jira/browse/SOLR-8307

Plugin Details

Severity: High

ID: 9072

Family: CGI

Published: 2016/02/05

Modified: 2016/02/19

Dependencies: 8967

Risk Information

Risk Factor: High

CVSSv2

Base Score: 8.5

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

CVSSv3

Base Score: 8.2

Temporal Score: 7.8

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Temporal Vector: CVSS3#E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:apache:solr

Patch Publication Date: 2016/01/23

Vulnerability Publication Date: 2015/11/17