VYPR
Get started
← All advisories
Medium severity6.1NVD Advisory· Published Feb 15, 2016· Updated May 6, 2026

CVE-2015-8796

CVE-2015-8796

Description

Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/schema-browser.js in the Admin UI in Apache Solr before 5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted schema-browse URL.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.solr:solrMaven
< 5.35.3

Affected products

1
  • Apache/Solr
    cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*
    Range: <=5.2.1

Patches

2
dc2f2295e0a6

SOLR-7920 XSS issue in old schema-browser page

https://github.com/apache/luceneUpayaviraAug 16, 2015via ghsa
commit
1 file changed · +1 −1
  • solr/webapp/web/js/scripts/schema-browser.js+1 −1 modified
    @@ -273,7 +273,7 @@ sammy.bind
         'types' : []
       }
 
-      $( 'option[value="' + params.route_params.path + '"]', related_select_element )
+      $( 'option[value="' + params.route_params.path.esc() + '"]', related_select_element )
         .attr( 'selected', 'selected' );
 
       related_select_element
dc2f2295e0a6

SOLR-7920 XSS issue in old schema-browser page

https://github.com/apache/solrUpayaviraAug 16, 2015via ghsa
commit
1 file changed · +1 −1
  • solr/webapp/web/js/scripts/schema-browser.js+1 −1 modified
    @@ -273,7 +273,7 @@ sammy.bind
         'types' : []
       }
 
-      $( 'option[value="' + params.route_params.path + '"]', related_select_element )
+      $( 'option[value="' + params.route_params.path.esc() + '"]', related_select_element )
         .attr( 'selected', 'selected' );
 
       related_select_element

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.