Not rated
CVE-2018-1308 This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in…
Description
This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Solr | Versions not published |
References
- DSA-4194 www.debian.org
- [debian-lts-announce] 20180424 [SECURITY] [DLA 1360-1] lucene-solr security update lists.debian.org
- [www-announce] 20180408 [SECURITY] CVE-2018-1308: XXE attack through Apache Solr's DIH's dataConfig request parameter mail-archives.apache.org
- issues.apache.org issues.apache.org
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Solr
The 24 CVEs of Apache Solr →
CVE-2026-44825
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0…
8.1
High
CVE-2026-22022
Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable…
Not rated
CVE-2026-22444
The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters,…
Not rated
CVE-2025-24814
Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use…
Not rated