Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2013-12-07T20:00:00

Updated: 2024-08-06T17:39:01.267Z

Reserved: 2013-11-04T00:00:00

Link: CVE-2013-6397

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2013-12-07T20:55:02.633

Modified: 2024-11-21T01:59:08.797

Link: CVE-2013-6397

cve-icon Redhat

Severity : Important

Publid Date: 2013-11-26T00:00:00Z

Links: CVE-2013-6397 - Bugzilla