Read the docs
TI-2013-05353 Aliases CVE-2013-6397GHSA-j8qw-mwmv-28cg

Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows…

Priority MEDIUM 53CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · None · None
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.

Why it matters now

EPSS 0.5653 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.apache.solr:solr-core (Maven): 4.6.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.solr:solr-core (Maven)before 4.6.04.6.0Patch availableGHSA-j8qw-mwmv-28cg
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.solr:solr-core (Maven) Vendor— Affected before 4.6.0 Fixed in 4.6.0 Patch available GHSA-j8qw-mwmv-28cg

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*up to 4.5.1VulnerableApache
cpe:2.3:a:apache:solr:4.0.0:*:*:*:*:*:*:*4.0.0VulnerableApache
cpe:2.3:a:apache:solr:4.0.0:alpha:*:*:*:*:*:*4.0.0 alphaVulnerableApache
cpe:2.3:a:apache:solr:4.0.0:beta:*:*:*:*:*:*4.0.0 betaVulnerableApache
cpe:2.3:a:apache:solr:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableApache
cpe:2.3:a:apache:solr:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableApache
cpe:2.3:a:apache:solr:4.2.1:*:*:*:*:*:*:*4.2.1VulnerableApache
cpe:2.3:a:apache:solr:4.3.0:*:*:*:*:*:*:*4.3.0VulnerableApache
cpe:2.3:a:apache:solr:4.3.1:*:*:*:*:*:*:*4.3.1VulnerableApache
cpe:2.3:a:apache:solr:4.4.0:*:*:*:*:*:*:*4.4.0VulnerableApache
  • cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* Versions up to 4.5.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:4.0.0:alpha:*:*:*:*:*:* Versions 4.0.0 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:4.0.0:beta:*:*:*:*:*:* Versions 4.0.0 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:4.3.1:*:*:*:*:*:*:* Versions 4.3.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:solr:4.4.0:*:*:*:*:*:*:* Versions 4.4.0 Vulnerable ·Apache
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:solr:4.5.0:*:*:*:*:*:*:*4.5.0VulnerableApache
  • cpe:2.3:a:apache:solr:4.5.0:*:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-j8qw-mwmv-28cg org.apache.solr:solr-core (Maven) Fixed in 4.6.0 Advisory →

Red Hat 2 advisories

  • RHSA-2014:0029 Released 2014-01-15 · Red Hat rating Important
    Red Hat JBoss Data Grid 6.2.0 update
    • Red Hat JBoss Data Grid 6.2
  • RHSA-2013:1844 Released 2013-12-16 · Red Hat rating Important
    Red Hat JBoss Web Framework Kit 2.4.0 update
    • Red Hat JBoss Web Framework Kit 2.4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Grid 6AffectedNo fix yet
Red Hat JBoss Data Grid 6.2Fixed RHSA-2014:0029
Red Hat JBoss Web Framework Kit 2.4Fixed RHSA-2013:1844

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-6397
  2. 2026-10-03 Alias added: GHSA-j8qw-mwmv-28cg

References

Exploit 1

Patch 1

Advisory 3

Other 5

  • TI-2024-30303 Apache Solr: Authentication bypass possible using a fake URL Path ending CVSS 3.1CRITICAL 9.8
  • TI-2019-13101 Injection in Apache Solr KEVCVSS 3.1HIGH 7.5
  • TI-2019-00170 Code injection in Apache Solr KEVCVSS 3.1HIGH 7.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2021-09240 SSRF vulnerability with the Replication handler CVSS 3.1CRITICAL 9.8
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences