Incorrect Authorization in Apache Solr

CRITICAL 9.8CVE-2020-13957 · BIT-solr-2020-13957 · GHSA-3c7p-vv5r-cmr5 · Published 13/10/2020 · updated 17/06/2026

In short

CVE-2020-13957 is a CRITICAL (CVSS 9.8) vulnerability affecting org.apache.solr:solr-core, org.apache.solr:solr-parent, org.apache.solr:solr-solrj.
Chance of exploitation in the next 30 days (EPSS): 79.3%, higher than 99.6% of all vulnerabilities.
Fix: update to 8.6.3 or later.

Package	Affected versions	Patched versions
org.apache.solr:solr-core Maven	`≥ 6.6.0, < 8.6.3`	`8.6.3`
org.apache.solr:solr-parent Maven	`≥ 6.6.0, < 8.6.3`	`8.6.3`
org.apache.solr:solr-solrj Maven	`≥ 6.6.0, < 8.6.3`	`8.6.3`
solr apache	`≥ 6.6.0, ≤ 6.6.6≥ 7.0.0, ≤ 7.7.3≥ 8.0.0, ≤ 8.6.2`	No fix yet

Description

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions. This issue is patched in 8.6.3.

NVD description

References

More vulnerabilities in org.apache.solr:solr-core

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free