Skip to content
Sign in
Not rated

CVE-2020-13957 Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous…

Description

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.

Affected products and versions

Product Affected versions Fixed in
Apache Solr Versions not published

Other CVEs of Apache Solr

The 3 CVEs of Apache Solr →
CVE-2020-13941 Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0 Not rated CVE-2019-17558 Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability 7.5 High
Track this CVE