CVE-2014-3628

Apache Solr 4.0.0-4.10.2 - Cross-Site Scripting via Admin UI Stats Page

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the Admin UI Plugin / Stats page in Apache Solr 4.x before 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the fieldvaluecache object.

References (2)

Core 2

Core References

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/62024

Various Sources mailing-list x_refsource_mlist

http://mail-archives.us.apache.org/mod_mbox/www-announce/201412.mbox/%3C54A1A7C7.2070804%40apache.org%3E

Scores

EPSS 0.0138

EPSS Percentile 80.6%

Details

CWE

CWE-79

Status published

Products (22)

apache/solr 4.0.0 (3 CPE variants)

apache/solr 4.1.0

apache/solr 4.2.0

apache/solr 4.2.1

apache/solr 4.3.0

apache/solr 4.3.1

apache/solr 4.4.0

apache/solr 4.5.0

apache/solr 4.5.1

apache/solr 4.6.0

... and 12 more

Published Jan 06, 2015

Tracked Since Feb 18, 2026