CVE-2015-8797: Apache Solr - Improper Neutralization of Input During Web Page Generation
Summary
CVE-2015-8797: Improper Neutralization of Input During Web Page Generation in Apache Solr. Affects org.apache.solr:solr-core versions < 5.3.1. Fixed in 5.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It provides full-text search, faceted search, and indexing capabilities. Solr is widely used in various applications for efficient and scalable search functionality. However, versions before 5.3.1 are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability exists in the stats page of the Admin UI in Apache Solr. The 'plugins.js' script in the 'webapp/web/js/scripts' directory does not properly neutralize user-supplied input. This allows remote attackers to inject arbitrary web script or HTML via the 'entry' parameter to a 'plugins/cache' URI. An attacker can exploit this vulnerability to execute malicious code in the context of a user's browser, potentially leading to session hijacking, data theft, or other attacks.
How To Fix
Latest published version: 10.0.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable access to the affected stats page in the Admin UI. This can be done by modifying the configuration to restrict access or by removing the vulnerable 'plugins.js' script. However, this is only a temporary solution, and upgrading to a patched version is strongly recommended.
Conclusion
The vulnerability in Apache Solr before version 5.3.1 allows remote attackers to inject arbitrary web script or HTML, potentially leading to various attacks. To mitigate this vulnerability, it is crucial to upgrade to Apache Solr 5.3.1 or later. If immediate upgrade is not possible, restricting access to the affected stats page or removing the vulnerable script can serve as a temporary workaround. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.solr:solr-core →
FAQ
The vulnerability allows remote attackers to inject malicious code into the Admin UI of Apache Solr, potentially leading to various attacks such as session hijacking, data theft, or unauthorized access.
No, authentication is not required. The vulnerability can be exploited remotely without any authentication.
No, only versions before 5.3.1 are affected. It is recommended to upgrade to the latest version to mitigate the vulnerability.
Yes, there are known exploits for this vulnerability. Attackers can inject arbitrary web script or HTML via the 'entry' parameter to the 'plugins/cache' URI.
Yes, Apache Solr version 5.3.1 includes a fix for this vulnerability. It is recommended to upgrade to this version or later.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.solr:solr-core.
