{"id":"CVE-2020-13957","aliases":["BIT-solr-2020-13957","CLSA-2026-1794298502","CLSA-2026-1794418162","CLSA-2026-1794486844","EUVD-2022-0788","GHSA-3c7p-vv5r-cmr5"],"status":"published","title":"Incorrect Authorization in Apache Solr","description":"Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.79342,"percentile":0.99607,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-863"],"published":"2020-10-13T18:28:52Z","modified":"2026-11-12T19:30:05Z","exploits":[{"source":"pocgithub","id":"s-index/CVE-2020-13957","title":"s-index/CVE-2020-13957","date":"2021-05-09","url":"https://github.com/s-index/CVE-2020-13957"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.solr:solr-parent","fixed_in":["8.6.3"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.solr:solr-solrj","fixed_in":["8.6.3"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.solr:solr-core","fixed_in":["8.6.3"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"solr","fixed_in":["6.6.7","7.7.4","8.6.3"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-solrj","fixed_in":["8.5.2-tuxcare.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.solr:solr-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0"},{"fixed":"8.6.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.solr:solr-solrj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0"},{"fixed":"8.6.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.solr:solr-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0"},{"fixed":"8.6.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"solr","ranges":[{"type":"SEMVER","events":[{"introduced":"6.6.0"},{"fixed":"6.6.7"},{"introduced":"7.0.0"},{"fixed":"7.7.4"},{"introduced":"8.0.0"},{"fixed":"8.6.3"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-solrj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.2"},{"fixed":"8.5.2-tuxcare.6"}]}],"versions":["8.5.2","8.5.2-tuxcare.1","8.5.2-tuxcare.2","8.5.2-tuxcare.3","8.5.2-tuxcare.4","8.5.2-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.2"},{"fixed":"7.7.2-tuxcare.1"}]}],"versions":["7.7.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.2"},{"fixed":"7.7.2-tuxcare.1"}]}],"versions":["7.7.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-solrj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.2"},{"fixed":"7.7.2-tuxcare.1"}]}],"versions":["7.7.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-analysis-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.3"},{"fixed":"7.7.3-tuxcare.1"}]}],"versions":["7.7.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-analytics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.3"},{"fixed":"7.7.3-tuxcare.1"}]}],"versions":["7.7.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-cell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.3"},{"fixed":"7.7.3-tuxcare.1"}]}],"versions":["7.7.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-clustering","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.3"},{"fixed":"7.7.3-tuxcare.1"}]}],"versions":["7.7.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.3"},{"fixed":"7.7.3-tuxcare.1"}]}],"versions":["7.7.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-dataimporthandler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.3"},{"fixed":"7.7.3-tuxcare.1"}]}],"versions":["7.7.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-dataimporthandler-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.3"},{"fixed":"7.7.3-tuxcare.1"}]}],"versions":["7.7.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-langid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.3"},{"fixed":"7.7.3-tuxcare.1"}]}],"versions":["7.7.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-ltr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.3"},{"fixed":"7.7.3-tuxcare.1"}]}],"versions":["7.7.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.3"},{"fixed":"7.7.3-tuxcare.1"}]}],"versions":["7.7.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-prometheus-exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.3"},{"fixed":"7.7.3-tuxcare.1"}]}],"versions":["7.7.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-solrj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.3"},{"fixed":"7.7.3-tuxcare.1"}]}],"versions":["7.7.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-test-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.3"},{"fixed":"7.7.3-tuxcare.1"}]}],"versions":["7.7.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.solr:solr-velocity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.3"},{"fixed":"7.7.3-tuxcare.1"}]}],"versions":["7.7.3"],"bundled":5},{"source":"osv","ecosystem":"Maven","package":"org.apache.solr:solr-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0"},{"fixed":"8.6.3"}]}],"versions":["6.6.0","6.6.1","6.6.2","6.6.3","6.6.4","6.6.5","6.6.6","7.0.0","7.0.1","7.1.0","7.2.0","7.2.1","7.3.0","7.3.1","7.4.0","7.5.0","7.6.0","7.7.0","7.7.1","7.7.2","7.7.3","8.0.0","8.1.0","8.1.1","8.2.0","8.3.0","8.3.1","8.4.0","8.4.1","8.5.0","8.5.1","8.5.2","8.6.0","8.6.1","8.6.2"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.solr:solr-solrj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0"},{"fixed":"8.6.3"}]}],"versions":["6.6.0","6.6.1","6.6.2","6.6.3","6.6.4","6.6.5","6.6.6","7.0.0","7.0.1","7.1.0","7.2.0","7.2.1","7.3.0","7.3.1","7.4.0","7.5.0","7.6.0","7.7.0","7.7.1","7.7.2","7.7.3","8.0.0","8.1.0","8.1.1","8.2.0","8.3.0","8.3.1","8.4.0","8.4.1","8.5.0","8.5.1","8.5.2","8.6.0","8.6.1","8.6.2"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.solr:solr-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0"},{"fixed":"8.6.3"}]}],"versions":["6.6.0","6.6.1","6.6.2","6.6.3","6.6.4","6.6.5","6.6.6","7.0.0","7.0.1","7.1.0","7.2.0","7.2.1","7.3.0","7.3.1","7.4.0","7.5.0","7.6.0","7.7.0","7.7.1","7.7.2","7.7.3","8.0.0","8.1.0","8.1.1","8.2.0","8.3.0","8.3.1","8.4.0","8.4.1","8.5.0","8.5.1","8.5.2","8.6.0","8.6.1","8.6.2"]}],"products":[{"vendor":"apache","product":"solr"},{"vendor":"apache software foundation","product":"apache solr"}],"references":[{"url":"https://mail-archives.us.apache.org/mod_mbox/www-announce/202010.mbox/%3CCAECwjAWCVLoVaZy%3DTNRQ6Wk9KWVxdPRiGS8NT%2BPHMJCxbbsEVg%40mail.gmail.com%3E","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r226c1112bb41e7cd427862d875eff9877a20a40242c2542f4dd39e4a%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r4ca8ba5980d9049cf3707798aa3116ee76c1582f171ff452ad2ca75e%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20201023-0002/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/r8b1782d42d0a4ce573495d5d9345ad328d652c68c411ccdb245c57e3%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r1c783d3d81ba62f3381a17a4d6c826f7dead3a132ba42349c90df075%40%3Ccommits.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r7512ae552cd9d14ab8b1bc0a7e95f2ec52ae85364f068d4034398ede%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9d7356f209ee30d702b6a921c866564eb2e291b126640c7ab70feea7%40%3Ccommits.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r5557641fcf5cfd99260a7037cfbc8788fb546b72c98a900570edaa2e%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r3d1e24a73e6bffa1d6534e1f34c8f5cbd9999495e7d933640f4fa0ed%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r13a728994c60be5b5a7049282b5c926dac1fc6a9a0b2362f6adfa573%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r2f8d33a4de07db9459fb2a98a1cd39747066137636b53f84a13e5628%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r853fdc6d0b91d5e01a26c7bd5becb044ad775a231703d634ca5d55c9%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r2236fdf99ac3efbfc36c2df96d3a88f822baa6f45e13fec7ff558e34%40%3Cdev.bigtop.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r999f828e6e37d9e825e207471cbfd2681c3befcd7f3abd59ed87c0d5%40%3Cissues.bigtop.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rb1de6ba50a468e9baff32a249edaa08f6bcec7dd7cc208e25e6b48c8%40%3Cissues.bigtop.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rf1a32f00017e83ff29a74be2de02e28e4302dddb5f14c624e297a8c0%40%3Cdev.bigtop.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r2a6600fe9afd502c04d26fd112823ec3f3c3ad1b4a289d10567a78a0%40%3Cdev.bigtop.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r3da9895cea476bcee2557531bebd4e8f6f367dc3ea900a65e2f51cd8%40%3Cissues.bigtop.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rb2f1c7fd3d3ea719dfac4706a80e6affddecae8663dda04e1335347f%40%3Ccommits.bigtop.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r622a043c2890327f8a4aea16b131e8a7137a282a004614369fceb224%40%3Cdev.bigtop.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13957","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread.html/r13a728994c60be5b5a7049282b5c926dac1fc6a9a0b2362f6adfa573@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r1c783d3d81ba62f3381a17a4d6c826f7dead3a132ba42349c90df075@%3Ccommits.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1@%3Ccommits.druid.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r2236fdf99ac3efbfc36c2df96d3a88f822baa6f45e13fec7ff558e34@%3Cdev.bigtop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r226c1112bb41e7cd427862d875eff9877a20a40242c2542f4dd39e4a@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r2a6600fe9afd502c04d26fd112823ec3f3c3ad1b4a289d10567a78a0@%3Cdev.bigtop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r2f8d33a4de07db9459fb2a98a1cd39747066137636b53f84a13e5628@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r3d1e24a73e6bffa1d6534e1f34c8f5cbd9999495e7d933640f4fa0ed@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r3da9895cea476bcee2557531bebd4e8f6f367dc3ea900a65e2f51cd8@%3Cissues.bigtop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r4ca8ba5980d9049cf3707798aa3116ee76c1582f171ff452ad2ca75e@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r5557641fcf5cfd99260a7037cfbc8788fb546b72c98a900570edaa2e@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r622a043c2890327f8a4aea16b131e8a7137a282a004614369fceb224@%3Cdev.bigtop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r7512ae552cd9d14ab8b1bc0a7e95f2ec52ae85364f068d4034398ede@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r853fdc6d0b91d5e01a26c7bd5becb044ad775a231703d634ca5d55c9@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r8b1782d42d0a4ce573495d5d9345ad328d652c68c411ccdb245c57e3@%3Cissues.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r999f828e6e37d9e825e207471cbfd2681c3befcd7f3abd59ed87c0d5@%3Cissues.bigtop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r9d7356f209ee30d702b6a921c866564eb2e291b126640c7ab70feea7@%3Ccommits.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rb1de6ba50a468e9baff32a249edaa08f6bcec7dd7cc208e25e6b48c8@%3Cissues.bigtop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rb2f1c7fd3d3ea719dfac4706a80e6affddecae8663dda04e1335347f@%3Ccommits.bigtop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rf1a32f00017e83ff29a74be2de02e28e4302dddb5f14c624e297a8c0@%3Cdev.bigtop.apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/solr/commit/e001c2221812a0ba9e9378855040ce72f93eced4","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20201023-0002","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3c7p-vv5r-cmr5"},{"url":"https://github.com/apache/lucene-solr","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-13957","description":"Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.","status":"published","published":"2020-10-13T18:28:52Z","modified":"2024-08-04T12:32:14.343Z","updated_at":"2026-11-02T14:35:54.170199Z"}],"euvd":[{"id":"EUVD-2022-0788","description":"Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.","status":"published","published":"2020-10-13T18:28:52Z","modified":"2024-08-04T12:32:14Z","updated_at":"2026-11-03T03:07:35.099081Z"}],"ghsa":[{"id":"GHSA-3c7p-vv5r-cmr5","title":"Incorrect Authorization in Apache Solr","description":"Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions. This issue is patched in 8.6.3.","status":"published","published":"2022-02-10T00:31:27Z","modified":"2025-03-17T21:39:03Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:38:35.74197Z"}],"nvd":[{"id":"CVE-2020-13957","description":"Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.","status":"published","published":"2020-10-13T19:15:12.46Z","modified":"2026-06-17T02:54:00.31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:06:19.351389Z"}],"osv":[{"id":"CVE-2020-13957","description":"Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.","status":"published","published":"2020-10-13T19:15:12.46Z","modified":"2026-10-24T10:30:50.411716816Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"GHSA-3c7p-vv5r-cmr5","title":"Incorrect Authorization in Apache Solr","description":"Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions. This issue is patched in 8.6.3.","status":"published","published":"2022-02-10T00:31:27Z","modified":"2025-03-17T22:06:48.644089Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"BIT-solr-2020-13957","description":"Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.","status":"published","published":"2024-03-06T11:07:17.601Z","modified":"2026-09-08T08:48:19.482283681Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"CLSA-2026-1794298502","title":"TuxCare security update for org.apache.solr:solr-solrj (1 CVE)","description":"TuxCare rebuilt org.apache.solr:solr-solrj to address 1 CVE. Fixed in 8.5.2-tuxcare.6.","status":"published","published":"2026-11-10T09:15:03Z","modified":"2026-11-10T13:15:02.38824676Z","updated_at":"2026-11-10T13:29:51.103746Z"},{"id":"CLSA-2026-1794418162","title":"TuxCare security update for org.apache.solr (5 CVEs)","description":"TuxCare rebuilt 3 org.apache.solr packages to address 5 CVEs. Fixed in 7.7.2-tuxcare.1.","status":"published","published":"2026-11-11T18:29:23Z","modified":"2026-11-12T01:15:02.17852313Z","updated_at":"2026-11-12T01:25:17.040581Z"},{"id":"CLSA-2026-1794486844","title":"TuxCare security update for org.apache.solr (5 CVEs)","description":"TuxCare rebuilt 14 org.apache.solr packages to address 5 CVEs. Fixed in 7.7.3-tuxcare.1.","status":"published","published":"2026-11-12T13:34:04Z","modified":"2026-11-12T19:30:05.284584532Z","updated_at":"2026-11-12T19:43:48.38408Z"}]}}