CVE-2018-8026

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files (currency.xml, enumsConfig.xml referred from schema.xml, TIKA parsecontext config file). In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerability can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network. The manipulated files can be uploaded as configsets using Solr's API, allowing to exploit that vulnerability.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Solr	6.0.0 to 6.6.4; 7.0.0 to 7.3.1

References

http://www.securityfocus.com/bid/104690Third Party Advisory, VDB Entry
https://issues.apache.org/jira/browse/SOLR-12450Exploit, Issue Tracking, Vendor Advisory
https://mail-archives.apache.org/mod_mbox/lucene-solr-user/201807.mbox/%3C0cdc01d413b7%24f97ba580%24ec72f080%24%40apache.org%3EMailing List, Vendor Advisory
https://security.netapp.com/advisory/ntap-20190307-0002/Third Party Advisory
http://www.securityfocus.com/bid/104690Third Party Advisory, VDB Entry
https://issues.apache.org/jira/browse/SOLR-12450Exploit, Issue Tracking, Vendor Advisory
https://mail-archives.apache.org/mod_mbox/lucene-solr-user/201807.mbox/%3C0cdc01d413b7%24f97ba580%24ec72f080%24%40apache.org%3EMailing List, Vendor Advisory
https://security.netapp.com/advisory/ntap-20190307-0002/Third Party Advisory

Timeline

Published: Jul 5, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-80279.8Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.CVE-2018-80288.8An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an CVE-2018-80298.8In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run a CVE-2018-80307.5A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to pu CVE-2018-80316.1The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious CVE-2018-80326.1Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.CVE-2018-80337.5In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP serv CVE-2018-80347.5The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tom CVE-2018-80356.1This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2)CVE-2018-80366.5In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an CVE-2018-80375.9If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed CVE-2018-80387.5Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider