CVE-2013-6408: XML Injection in Apache Solr
Summary
CVE-2013-6408: XML Injection in Apache Solr. Affects org.apache.solr:solr-core versions < 4.3.1. Fixed in 4.3.1. How to fix ↓
Also tracked for
- lucene-solr · Debian:11
The same CVE-2013-6408 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It provides full-text search, faceted search, and distributed search capabilities. Solr is widely used in various applications for indexing and searching large volumes of data. However, versions before 4.3.1 are vulnerable to XML Injection.
Vulnerability Detail
The vulnerability, known as XML Injection (CVE-2013-6408), exists in the DocumentAnalysisRequestHandler of Apache Solr. It arises due to improper usage of the EmptyEntityResolver, allowing remote attackers to exploit XML data containing an external entity declaration in conjunction with an entity reference. This vulnerability can lead to an XML External Entity (XXE) issue, potentially resulting in unauthorized access, data leakage, or denial of service.
How To Fix
Latest published version: 10.0.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, you can apply a workaround by modifying the Solr configuration. Disable the DocumentAnalysisRequestHandler by removing or commenting out its entry in the solrconfig.xml file. This will prevent the vulnerable component from being accessible and mitigate the risk of XML Injection.
Conclusion
The XML Injection vulnerability in Apache Solr (CVE-2013-6408) can have serious security implications, potentially leading to unauthorized access, data leakage, or denial of service. It is crucial to upgrade to the fixed version (4.3.1 or later) or apply the provided workaround to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.solr:solr-core →
FAQ
Apache Solr is an open-source search platform built on Apache Lucene. It provides powerful search capabilities for indexing and querying large volumes of data.
XML Injection is a vulnerability that occurs when untrusted XML input is processed by an application in an unsafe manner. It can lead to various security risks, such as unauthorized access, data leakage, or denial of service.
The XML Injection vulnerability in Apache Solr can allow remote attackers to exploit XML data containing external entity declarations and entity references. This can result in unauthorized access to sensitive data, data leakage, or denial of service.
Yes, the XML Injection vulnerability in Apache Solr has been fixed in version 4.3.1. It is recommended to upgrade to this version or later to mitigate the risk.
Yes, if immediate upgrade is not feasible, you can disable the vulnerable component, DocumentAnalysisRequestHandler, in the Solr configuration. This can help mitigate the risk until the upgrade can be performed.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.solr:solr-core.
