NVD

Id
41455  
Name
CVE-2013-6397  
Description
Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-18  
Published
2013-12-07  
Modified Date
2015-10-23  
Seq
2013-6397  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
209445 41455 CVE-2013-6397 http://lucene.apache.org/solr/4_6_0/changes/Changes.html  View
209446 41455 CVE-2013-6397 RHSA-2013:1844  View
209447 41455 CVE-2013-6397 RHSA-2014:0029  View
209448 41455 CVE-2013-6397 http://www.agarri.fr/kom/archives/2013/11/27/compromising_an_unreachable_solr_server_with_cve-2013-6397/index.html  View
209449 41455 CVE-2013-6397 [oss-security] 20131126 Re: CVE request: Apache Solr 4.6.0  View
209450 41455 CVE-2013-6397 63935  View
209451 41455 CVE-2013-6397 https://issues.apache.org/jira/browse/SOLR-4882  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
23820 JVNDB-2013-005395 Apache Solr の SolrResourceLoader におけるディレクトリトラバーサルの脆弱性 Apache Solr の SolrResourceLoader には、response writer (wt パラメータ) が XSLT に設定されている場合、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2013-6397 66339 CVE-2013-6397 41455 4.3 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-005395.html 2013-09-21 2014-04-07 View