9.8

CVE-2020-13957: apache solr Incorrect Authorization

CVSS: 9.8v3.1CriticalModified
AliasesGHSA-3c7p-vv5r-cmr5BIT-solr-2020-13957
Published 13-10-2020Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2020-13957 is a critical (CVSS 9.8) Incorrect Authorization vulnerability in apache solr. EPSS estimates a 79.34% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
79.34%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 13-10-2020
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

79.34%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 79.34% on 18-09-2026

18-09-202618-10-2026
EPSS score
79.34%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Org.apache.solr3 products
  • solr-core≥ 6.6.0, < 8.6.3
  • solr-parent≥ 6.6.0, < 8.6.3
  • solr-solrj≥ 6.6.0, < 8.6.3
Apache1 product
  • solr≥ 6.6.0, ≤ 6.6.6 | ≥ 7.0.0, ≤ 7.7.3 | ≥ 8.0.0, ≤ 8.6.2

2 vendors · 4 products

References

46 links
Show all 46 references