CVE-2013-6408
XML Injection in Apache Solr
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
Exploit likelihood
What each source reports
NVD Score used
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
- Record
CVE-2013-6408- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
- Record
CVE-2013-6408- Updated
- 2026-11-02
EUVDEUVD-2022-2310 No score
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
- Record
EUVD-2022-2310- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-45w3-2hvv-pfxq No score
XML Injection in Apache Solr
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
- Record
GHSA-45w3-2hvv-pfxq- Weakness
- CWE-91
- Updated
- 2026-11-02
OSV No score
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
- Record
CVE-2013-6408- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-6408 No score
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
- Record
DEBIAN-CVE-2013-6408- Updated
- 2026-11-02
OSVGHSA-45w3-2hvv-pfxq No score
XML Injection in Apache Solr
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
- Record
GHSA-45w3-2hvv-pfxq- Weakness
- CWE-91
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-6408 No score
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
- Record
UBUNTU-CVE-2013-6408- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.solr:solr-coreMaven |
before 4.3.1 | 4.3.1 |
lucene-solrDebian:12 |
before 3.6.2+dfsg-2 | 3.6.2+dfsg-2 |
lucene-solrDebian:13 |
before 3.6.2+dfsg-2 | 3.6.2+dfsg-2 |
lucene-solrDebian:14 |
before 3.6.2+dfsg-2 | 3.6.2+dfsg-2 |
lucene-solrDebian:7 From an advisory covering 4 CVEs |
before 3.6.0+dfsg-1+deb7u1, plus listed versions 3.6.0+dfsg-1 |
3.6.0+dfsg-1+deb7u1 |
org.apache.solr:solr-coreMaven |
before 4.3.1, plus listed versions 1.3.01.4.01.4.13.1.03.2.0 Show 13 moreShow less3.3.03.4.03.5.03.6.03.6.13.6.24.0.04.0.0-ALPHA4.0.0-BETA4.1.04.2.04.2.14.3.0 |
4.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-6408 is a medium vulnerability (CVSS 6.4) in Apache Solr, published December 7, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.4%, the 96th percentile. Fixed in org.apache.solr:solr-core 4.3.1.
References
rhn.redhat.com/errata/RHSA-2014-0029.html
secunia.com/advisories/55542
openwall.com/lists/oss-security/2013/11/29/2
svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt?view=markup
Show 9 moreShow less
issues.apache.org/jira/browse/SOLR-4881
nvd.nist.gov/vuln/detail/CVE-2013-6408
github.com/apache/lucene-solr/commit/7239a57a51ea0f4d05dd330ce5e15e4f72f72747
security-tracker.debian.org/tracker/CVE-2013-6408
ubuntu.com/security/CVE-2013-6408
cve.org/CVERecord?id=CVE-2013-6408