{"id":"CVE-2019-12401","published":"2019-09-10T14:06:54Z","modified":"2024-08-04T23:17:40Z","title":"Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack…","vendor":"Apache","product":"Solr","tier":"tail","description":{"text":"Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML causing OOMs.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.08547,"percentile":0.95042,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/7ab5e95a1a0b4f35ffe53f1eb0cb74b4348b49d41b72ac155b843fa2%40%3Cgeneral.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/048ae6e4f84a88e8856f766320b48ad91f9fca2c6f621aa2c40088fe%40%3Cdev.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2019/09/10/1","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/521d10a19bfb590f86dff41820ccfb11e92281f233a12c882650931e%40%3Cdev.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/1c92300643f48f13bc59b15e3f886ba62bae1798c7d4c2e5c1ece09b%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/60a924662ead9aeea74e8ea128d9ca935f8de925aa71b15ab2787d6a%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/db8eaca456d03c00a66cbe37548978318d424b9997e3fd7f5c65dffe%40%3Cdev.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://mail-archives.us.apache.org/mod_mbox/www-announce/201909.mbox/%3CCAECwjAXU4%3DkAo5DeUJw7Kvk67sgCmajAN7LGZQNjbjZ8gv%3DBdw%40mail.gmail.com%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/0ec231c5ed8d242890e21806d25fdd47f80cc47cac278d2fc1c9c579%40%3Cdev.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://security.netapp.com/advisory/ntap-20190926-0002/","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-12401-XML%20Bomb-Apache%20Solr","tags":["x_refsource_MISC"]}],"priority":{"score":24.0,"factors":[{"name":"EPSS percentile","points":19.01},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-02-12","earliestUrl":"https://github.com/mbadanoiu/CVE-2019-12401","repos":[{"name":"mbadanoiu/CVE-2019-12401","url":"https://github.com/mbadanoiu/CVE-2019-12401","stars":0,"created":"2025-02-12"}]},"first":{"date":"2025-02-12","source":"PoC-in-GitHub","url":"https://github.com/mbadanoiu/CVE-2019-12401"},"provenance":"source"},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache","product":"Solr","versions":["1.3.0 to 1.4.1","3.1.0 to 3.6.2","4.0.0 to 4.10.4"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.solr:solr-core","vulnerableRanges":["<5.0.0"],"patched":["5.0.0"],"from":["GHSA-jq2w-w7v2-69q5"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4413","exploited":false,"provenance":"source"}}