CVE-2012-6612: Apache Solr - Improper Restriction of XML External Entity Reference
Summary
CVE-2012-6612: Improper Restriction of XML External Entity Reference in Apache Solr. Affects org.apache.solr:solr-core versions < 4.1.0. Fixed in 4.1.0. How to fix ↓
Also tracked for
- lucene-solr · Debian:11
The same CVE-2012-6612 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It provides full-text search capabilities, distributed indexing, and replication for fault tolerance and scalability. The solr-core package is a core component of Apache Solr, responsible for handling search requests and managing the search index.
Vulnerability Detail
The vulnerability, identified as CVE-2012-6612, affects the UpdateRequestHandler for XSLT and XPathEntityProcessor in Apache Solr versions prior to 4.1. It arises due to the improper restriction of XML external entity references. Attackers can exploit this vulnerability by providing XML data containing an external entity declaration along with an entity reference. This can lead to an XML External Entity (XXE) issue, resulting in various unspecified impacts. It is important to note that this vulnerability is different from CVE-2013-6407.
How To Fix
Latest published version: 10.0.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, applying the recommended fix by upgrading to Apache Solr 4.1.0 or later is the best approach to address the issue.
Conclusion
The vulnerability in Apache Solr, identified as CVE-2012-6612, allows remote attackers to exploit an XML External Entity (XXE) issue. To mitigate this vulnerability, it is crucial to upgrade to Apache Solr version 4.1.0 or later. This upgrade ensures the proper handling of XML external entity references and enhances the security of the Solr search platform. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.solr:solr-core →
FAQ
Apache Solr is an open-source search platform built on Apache Lucene. It provides full-text search capabilities, distributed indexing, and replication for fault tolerance and scalability.
The solr-core package is a core component of Apache Solr responsible for handling search requests and managing the search index.
CVE-2012-6612 is a vulnerability in Apache Solr that allows remote attackers to exploit an XML External Entity (XXE) issue by providing XML data containing an external entity declaration and an entity reference.
To fix this vulnerability, it is recommended to upgrade to Apache Solr version 4.1.0 or later.
There is no specific workaround mentioned for this vulnerability. Upgrading to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.solr:solr-core.
