CVE-2013-6397

Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .

published December 7, 2013

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.0th percentile for exploit probability.

CVSS
—
EPSS
56%
Percentile
99.0
In the wild
Unconfirmed
What it is

Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.56255 · 99.0th percentile
Published
2013-12-07T20:00Z
EPSS history
Timeline
  • 07 DEC 20:00Z
    Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .
    cvelistv5