CVE-2013-6397

Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.

• CWE-22

• http://lucene.apache.org/solr/4_6_0/changes/Changes.html
• http://rhn.redhat.com/errata/RHSA-2013-1844.html
• http://rhn.redhat.com/errata/RHSA-2014-0029.html
• http://secunia.com/advisories/55730Vendor Advisory
• http://secunia.com/advisories/59372
• http://www.agarri.fr/kom/archives/2013/11/27/compromising_an_unreachable_solr_server_with_cve-2013-6397/index.htmlExploit
• http://www.openwall.com/lists/oss-security/2013/11/27/1
• http://www.securityfocus.com/bid/63935
• https://issues.apache.org/jira/browse/SOLR-4882Patch
• http://lucene.apache.org/solr/4_6_0/changes/Changes.html
• http://rhn.redhat.com/errata/RHSA-2013-1844.html
• http://rhn.redhat.com/errata/RHSA-2014-0029.html
• http://secunia.com/advisories/55730Vendor Advisory
• http://secunia.com/advisories/59372
• http://www.agarri.fr/kom/archives/2013/11/27/compromising_an_unreachable_solr_server_with_cve-2013-6397/index.htmlExploit
• http://www.openwall.com/lists/oss-security/2013/11/27/1
• http://www.securityfocus.com/bid/63935
• https://issues.apache.org/jira/browse/SOLR-4882Patch

Published

Dec 7, 2013

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-6391The ec2tokens API in OpenStack Identity (Keystone) before Ha…
• CVE-2013-6392The genlock_dev_ioctl function in genlock.c in the Genlock d…
• CVE-2013-6393The yaml_parser_scan_tag_uri function in scanner.c in LibYAM…
• CVE-2013-6394Percona XtraBackup before 2.1.6 uses a constant string for t…
• CVE-2013-6395Cross-site scripting (XSS) vulnerability in header.php in Ga…
• CVE-2013-6396The OpenStack Python client library for Swift (python-swiftc…
• CVE-2013-6398The virtual router in Apache CloudStack before 4.2.1 does no…
• CVE-2013-6399Array index error in the virtio_load function in hw/virtio/v…
• CVE-2013-6400Xen 4.2.x and 4.3.x, when using Intel VT-d and a PCI device …
• CVE-2013-6401Jansson, possibly 2.4 and earlier, does not restrict the abi…
• CVE-2013-6402base/pkit.py in HP Linux Imaging and Printing (HPLIP) throug…
• CVE-2013-6403The admin page in ownCloud before 5.0.13 allows remote attac…