Vulnerability in Apache Solr
CVE-2019-12401
Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a…
EPSS: 0.328 (97.0th percentile) — read the EPSS interpretation.
Affected products
- Apache Solr — versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2, 4.0.0 to 4.10.4
Public proof-of-concept exploits
References
- [lucene-general] 20190909 [SECURITY] CVE-2019-12401: XML Bomb in Apache Solr versions prior to 5.0 (mailing-list, x_refsource_MLIST)
- [lucene-dev] 20190909 [SECURITY] CVE-2019-12401: XML Bomb in Apache Solr versions prior to 5.0 (mailing-list, x_refsource_MLIST)
- [oss-security] 20190909 [SECURITY] CVE-2019-12401: XML Bomb in Apache Solr versions prior to 5.0 (mailing-list, x_refsource_MLIST)
- [lucene-dev] 20190909 [jira] [Resolved] (SOLR-13750) [CVE-2019-12401] XML Bomb in Apache Solr versions prior to 5.0.0 (mailing-list, x_refsource_MLIST)
- [announce] 20190909 [SECURITY] CVE-2019-12401: XML Bomb in Apache Solr versions prior to 5.0 (mailing-list, x_refsource_MLIST)
- [lucene-solr-user] 20190909 [SECURITY] CVE-2019-12401: XML Bomb in Apache Solr versions prior to 5.0 (mailing-list, x_refsource_MLIST)
- [lucene-dev] 20190909 [jira] [Updated] (SOLR-13750) [CVE-2019-12401] XML Bomb in Apache Solr versions prior to 5.0.0 (mailing-list, x_refsource_MLIST)
- [www-announce] 20190909 [SECURITY] CVE-2019-12401: XML Bomb in Apache Solr versions prior to 5.0 (mailing-list, x_refsource_MLIST)
- [lucene-dev] 20190911 [jira] [Commented] (SOLR-13750) [CVE-2019-12401] XML Bomb in Apache Solr versions prior to 5.0.0 (mailing-list, x_refsource_MLIST)
- security.netapp.com/advisory/ntap-20190926-0002/ (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2019-12401?
- CVE-2019-12401 is a vulnerability in Apache Solr. Published 2019-09-10.
- Is CVE-2019-12401 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.