CVE-2018-1308

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published
Apr 9, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-130807.5The mintToken function of a smart contract implementation for Goutex (GTX), an Ethereum token, has an integer overflow that allows the ownerCVE-2018-130817.5The mintToken function of a smart contract implementation for GZS Token (GZS), an Ethereum token, has an integer overflow that allows the owCVE-2018-130827.5The mintToken function of a smart contract implementation for MODI Token (MODI), an Ethereum token, has an integer overflow that allows the CVE-2018-130837.5The mintToken function of a smart contract implementation for Plaza Token (PLAZA), an Ethereum token, has an integer overflow that allows thCVE-2018-130847.5The mintToken function of a smart contract implementation for Good Time Coin (GTY), an Ethereum token, has an integer overflow that allows tCVE-2018-130857.5The mintToken function of a smart contract implementation for FreeCoin (FREE), an Ethereum token, has an integer overflow that allows the owCVE-2018-130867.5The mintToken function of a smart contract implementation for IADOWR Coin (IAD), an Ethereum token, has an integer overflow that allows the CVE-2018-130877.5The mintToken function of a smart contract implementation for Coinstar (CSTR), an Ethereum token, has an integer overflow that allows the owCVE-2018-130887.5The mintToken function of a smart contract implementation for Futures Pease (FP), an Ethereum token, has an integer overflow that allows theCVE-2018-130897.5The mintToken function of a smart contract implementation for Universal Coin (UCOIN), an Ethereum token, has an integer overflow that allowsCVE-2018-13099.8Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code executiCVE-2018-130907.5The mintToken function of a smart contract implementation for YiTongCoin (YTC), an Ethereum token, has an integer overflow that allows the o
CVE-2018-1308: High severity, CVSS 7.5 | Vulnix