-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.solr:solr-core | maven | < 4.1.0 | 4.1.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of XML external entities in Apache Solr's XML processing components. The patch introduces EmptyEntityResolver to explicitly block external entity resolution. The XMLLoader (responsible for XML updates) and XPathRecordReader (part of DataImportHandler) were both modified to use this resolver. The pre-patch versions of these components lacked these safeguards, making their XML parsing functions vulnerable. The test cases added in the commit (e.g., testExternalEntities) directly validate() that these components no longer resolve external entities, confirming the vulnerable entry points.
JavaJavaOngoing coverage of React2Shell