CVE-2013-6397

Improper Limitation of a Pathname to a Restricted Directory in Apache Solr

4.3 MediumFix available

CVE-2013-6397 is a medium vulnerability (CVSS 4.3) in Apache Solr, published December 7, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 56.5%, the 99th percentile. Fixed in org.apache.solr:solr-core 4.6.0.

What does this mean?

Severity: 4.3 MediumCVSS 2.0, NVD
Exploit chance: 56.5%EPSS, 99th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 4.6.0org.apache.solr:solr-core +5 more

Description

Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.

Exploit likelihood

56.5%Up 53.1 points since Feb 4, 2022

Affected products

apache solr

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.solr:solr-core` Maven	before 4.6.0	4.6.0
`lucene-solr` Debian:12	before 3.6.2+dfsg-2	3.6.2+dfsg-2
`lucene-solr` Debian:13	before 3.6.2+dfsg-2	3.6.2+dfsg-2
`lucene-solr` Debian:14	before 3.6.2+dfsg-2	3.6.2+dfsg-2
`lucene-solr` Debian:7 From an advisory covering 4 CVEs	before 3.6.0+dfsg-1+deb7u1, plus listed versions 3.6.0+dfsg-1	3.6.0+dfsg-1+deb7u1
`org.apache.solr:solr-core` Maven	before 4.6.0, plus listed versions 1.3.01.4.01.4.13.1.03.2.0 Show 17 moreShow less 3.3.03.4.03.5.03.6.03.6.13.6.24.0.04.0.0-ALPHA4.0.0-BETA4.1.04.2.04.2.14.3.04.3.14.4.04.5.04.5.1	4.6.0