cve.bz

CVE-2020-13957

9.8 criticalEPSS 79%

Critical (9.8) in apache solr. EPSS 79% chance of exploitation in the next 30 days. Fixed in org.apache.solr:solr-parent 8.6.3.

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
79% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE
CWE-863
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-3c7p-vv5r-cmr5Mavenorg.apache.solr:solr-parent>=6.6.0 <8.6.38.6.3
GHSA-3c7p-vv5r-cmr5Mavenorg.apache.solr:solr-solrj>=6.6.0 <8.6.38.6.3
GHSA-3c7p-vv5r-cmr5Mavenorg.apache.solr:solr-core>=6.6.0 <8.6.38.6.3

References

Check your stackJSON