GitHub Advisoryadvisory · Maven

GHSA-3c7p-vv5r-cmr5 Incorrect Authorization in Apache Solr

CRITICAL Published 2022-02-10 Modified 2025-03-17 Official page ↗
Aliases
CVE-2020-13957
Ecosystem
Maven
Packages
org.apache.solr:solr-parent, org.apache.solr:solr-solrj, org.apache.solr:solr-core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-863
Reviewed
2021-04-14

Affected packages

• Maven org.apache.solr:solr-parent: >= 6.6.0, < 8.6.3 → fixed in 8.6.3 • Maven org.apache.solr:solr-solrj: >= 6.6.0, < 8.6.3 → fixed in 8.6.3 • Maven org.apache.solr:solr-core: >= 6.6.0, < 8.6.3 → fixed in 8.6.3

Description

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions. This issue is patched in 8.6.3.

Related

Alias · CVE (1)

  • CVE-2020-13957 Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References