PT-2018-11581
CVE-2018-1308
·
تاريخ النشر
2018-04-09
·
تاريخ التحديث
2019-11-12
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Apache Solr versions 1.2 through 6.6.2
Apache Solr versions 7.0.0 through 7.2.1
Description
The issue relates to an XML external entity expansion (XXE) in the
&dataConfig=<inlinexml> parameter of Solr's DataImportHandler. This can be exploited to read arbitrary local files from the Solr server or the internal network using file, ftp, or http protocols.Recommendations
For Apache Solr versions 1.2 through 6.6.2, avoid using the
&dataConfig=<inlinexml> parameter in the DataImportHandler until a patch is available.
For Apache Solr versions 7.0.0 through 7.2.1, consider restricting access to the DataImportHandler to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾