{"id":"CVE-2015-8797","published":"2016-02-15T02:00:00Z","modified":"2024-08-06T08:29:22Z","title":"Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in…","vendor":null,"product":null,"tier":"tail","description":{"text":"Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via the entry parameter to a plugins/cache URI.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03286,"percentile":0.88423,"provenance":"source"},"cwes":[],"references":[{"url":"https://issues.apache.org/jira/browse/SOLR-7949","tags":["x_refsource_CONFIRM"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21975544","tags":["x_refsource_CONFIRM"]}],"priority":{"score":17.7,"factors":[{"name":"EPSS percentile","points":17.68}]},"affected":[{"ecosystem":"Maven","package":"org.apache.solr:solr-core","vulnerableRanges":["<5.3.1"],"patched":["5.3.1"],"from":["GHSA-v6gf-x8fp-532v"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5297","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2013-6397","published":"2013-12-07","fixed":"4.6.0","kev":false},{"cve":"CVE-2019-12401","published":"2019-09-10","fixed":"5.0.0","kev":false},{"cve":"CVE-2015-8795","published":"2016-02-15","fixed":"5.1.0","kev":false,"link":{"from":"CVE-2015-8795","to":"CVE-2015-8797","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.solr:solr-core","fromFixed":"5.1.0","toFixed":"5.3.1","daysApart":0},{"kind":"similar","provenance":"machine","score":0.41,"basis":"same package + description similarity"}]}},{"cve":"CVE-2015-8797","published":"2016-02-15","fixed":"5.3.1","kev":false},{"cve":"CVE-2017-3163","published":"2017-08-30","fixed":"6.4.1","kev":false,"link":{"from":"CVE-2015-8797","to":"CVE-2017-3163","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.solr:solr-core","fromFixed":"5.3.1","toFixed":"5.5.4","daysApart":562}]}},{"cve":"CVE-2017-7660","published":"2017-07-07","fixed":"6.6.0","kev":false},{"cve":"CVE-2017-9803","published":"2017-09-18","fixed":"6.6.1","kev":false}],"package":"Maven:org.apache.solr:solr-core"}}