VulnerabilityModified

CVE-2013-6397

Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a ..

MEDIUM 4.3EPSS 56.3%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 56.3%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
EPSS: 56.26% probability · 99th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: apache/solr
Source: secalert@redhat.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.