CVE-2020-13957
Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features…
Technology
Apache Solr
CVSS Score
9.8 / 10.0
Affected Versions
>=6.6.0 <=6.6.6; >=7.0.0 <=7.7.3; >=8.0.0 <=8.6.2
Upstream Fix
See upstream advisory
Published
October 13, 2020
OSSeva Coverage
Fixed upstream
Description
Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.
Is your Apache Solr deployment affected?
If you're running >=6.6.0 <=6.6.6; >=7.0.0 <=7.7.3; >=8.0.0 <=8.6.2, you need this patch. Book a discovery call to get covered.