Several critical vulnerabilities discovered in Apache Solr (XXE & RCE)

{
  "id": "b3e7f5204526554ee5d1d954b3f106721f9c0b0ba3f37607188958d03ddf41ba",
  "url": "https://solr.apache.org/several-critical-vulnerabilities-discovered-in-apache-solr-xxe-rce.html",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Several critical vulnerabilities discovered in Apache Solr (XXE & RCE)",
    "summary": "Apache Solr releases 6.6.2 and 7.1.0 address two vulnerabilities: XML external entity expansion in the XML Query Parser and remote code execution via RunExecutableListener. Users unable to upgrade are advised to disable configuration edits and remap the XML Query Parser.",
    "evidence": "Users are advised to upgrade to either Solr 6.6.2 or Solr 7.1.0 releases both of which address the two vulnerabilities.",
    "products": [
      {
        "name": {
          "value": "Solr",
          "evidence": "Versions Affected: Solr 5.5.0 to 5.5.4"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "Solr 6.6.2",
            "evidence": "Users are advised to upgrade to either Solr 6.6.2 or Solr 7.1.0 releases both of which address the two vulnerabilities."
          },
          {
            "value": "Solr 7.1.0",
            "evidence": "Users are advised to upgrade to either Solr 6.6.2 or Solr 7.1.0 releases both of which address the two vulnerabilities."
          }
        ],
        "affected_versions": [
          {
            "value": "Solr 5.5.0 to 5.5.4",
            "evidence": "Versions Affected: Solr 5.5.0 to 5.5.4"
          },
          {
            "value": "Solr 6.0.0 to 6.6.1",
            "evidence": "Solr 6.0.0 to 6.6.1"
          },
          {
            "value": "Solr 7.0.0 to 7.0.1",
            "evidence": "Solr 7.0.0 to 7.0.1"
          }
        ]
      }
    ],
    "severity": "critical",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": "Severity: Critical"
  },
  "source_id": "official-apache-solr-security",
  "document_id": 23002,
  "published_at": "2017-10-18T00:00:00+00:00"
}