AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SolrGHSA-3c7p-vv5r-cmr5

Incorrect Authorization in Apache Solr

Apache Solr

CVE-2020-13957 · Published Feb 10, 2022 · updated Mar 17, 2025

Critical9.8
Fix: upgrade to 8.6.3 or later
GitHub advisory

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions. This issue is patched in 8.6.3.

Affected versions

PackageAffectedFixed in
org.apache.solr:solr-core
Maven
>= 6.6.0, < 8.6.38.6.3
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-863
Also known as
BIT-solr-2020-13957, CVE-2020-13957

More Apache Solr advisories

All Apache Solr
MediumMay 17, 2022Improper Limitation of a Pathname to a Restricted Directory in Apache SolrCVE-2013-6397fixed in 4.6.0Medium 6.1May 17, 2022Improper Neutralization of Input During Web Page Generation in Apache SolrCVE-2015-8795fixed in 5.1.0Medium 6.1May 17, 2022Improper Neutralization of Input During Web Page Generation in Apache SolrCVE-2015-8797fixed in 5.3.1High 7.5May 14, 2022Apache Solr insecure inter-node communicationCVE-2017-7660fixed in 5.5.5 +1High 7.5May 14, 2022Apache Solr Kerberos delegation token functionality flawsCVE-2017-9803fixed in 6.6.1Medium 4.3Feb 9, 2022Incorrect Authorization in Apache SolrCVE-2018-11802fixed in 6.6.6 +1