{"id":"CVE-2018-1308","published":"2018-04-09T13:00:00Z","modified":"2024-09-17T02:47:11Z","title":"This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in…","vendor":"Apache","product":"Apache Solr","tier":"tail","description":{"text":"This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.20823,"percentile":0.97547,"provenance":"source"},"cwes":[],"references":[{"url":"https://www.debian.org/security/2018/dsa-4194","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00025.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://mail-archives.apache.org/mod_mbox/www-announce/201804.mbox/%3C000001d3cf68%245ac69af0%241053d0d0%24%40apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://issues.apache.org/jira/browse/SOLR-11971","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":19.5,"factors":[{"name":"EPSS percentile","points":19.51}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Solr","versions":["1.2 to 6.6.2","7.0.0 to 7.2.1"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.solr:solr-core","vulnerableRanges":[">=1.2, <6.6.3",">=7.0.0, <7.3.0"],"patched":["6.6.3","7.3.0"],"from":["GHSA-3pph-2595-cgfh"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0489","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2017-9803","published":"2017-09-18","fixed":"6.6.1","kev":false},{"cve":"CVE-2019-0192","published":"2019-03-07","fixed":"7.0.0","kev":false},{"cve":"CVE-2017-12629","published":"2017-10-14","fixed":"7.1.0","kev":false,"link":{"from":"CVE-2017-12629","to":"CVE-2018-1308","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.solr:solr-core","fromFixed":"7.1.0","toFixed":"7.3.0","daysApart":177},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.solr:solr-core","fromFixed":"6.6.2","toFixed":"6.6.3","daysApart":177}]}},{"cve":"CVE-2018-1308","published":"2018-04-09","fixed":"7.3.0","kev":false},{"cve":"CVE-2018-8010","published":"2018-05-21","fixed":"7.3.1","kev":false,"link":{"from":"CVE-2018-1308","to":"CVE-2018-8010","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.solr:solr-core","fromFixed":"7.3.0","toFixed":"7.3.1","daysApart":42},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.solr:solr-core","fromFixed":"6.6.3","toFixed":"6.6.4","daysApart":42}]}},{"cve":"CVE-2018-8026","published":"2018-07-05","fixed":"7.4.0","kev":false},{"cve":"CVE-2017-3164","published":"2019-03-08","fixed":"7.7.0","kev":false}],"package":"Maven:org.apache.solr:solr-core"}}