CVE-2013-6397 EPSS 56.3%

Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read…

Official description · CVE.org

Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.

Breakdown

54.8 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 0
Tactics: 0/15

First seen exploited 11 years after disclosure.

Disclosed7 Dec 2013day 0
First seen exploitedVulnCheck KEV evidence19 Sep 2024+11 yrs

7 fixes in solr-core over 6 years. The latest fix listed for solr-core is 5.3.1.

Fixes in solr-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

4.1.0CVE-2012-66127 Dec 2013
4.1.0CVE-2013-64077 Dec 2013
4.3.1CVE-2013-64087 Dec 2013
4.6.0CVE-2013-63977 Dec 2013
5.0.0CVE-2019-1240110 Sep 2019
5.1.0CVE-2015-879515 Feb 2016
5.3.1CVE-2015-879715 Feb 2016Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.solr:solr-core.

Mavenorg.apache.solr:solr-coreGHSA-j8qw-mwmv-28cg

Upgrade to 4.6.0

Still affected on this line by CVE-2019-0193 (fixed in 8.2.0, a newer line).

Set the version to 4.6.0 or later in your pom.xml or build.gradle.

The first fix for CVE-2013-6397.

Affected versions

If you run	Upgrade to
All versions before 4.6.0	4.6.0

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

9 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-4317

No public exploit code found.

, 30 Oct 2026

56.3%Top 0.95%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.05%).

No CVSS score published.

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 772 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9905 19.8/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total54.8

Record

Published: 7 Dec 2013
Modified: 6 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in solr-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

References

vdb-entry 1

vendor-advisory 2

x_refsource_CONFIRM 2

mailing-list 1

third-party-advisory 2

x_refsource_MISC 1

techniques