~ / search / GHSA-3c7p-vv5r-cmr5

GHSA-3c7p-vv5r-cmr5

Incorrect Authorization in Apache Solr

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-13957

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.solr:solr-parent >= 6.6.0, < 8.6.3 8.6.3
Maven org.apache.solr:solr-solrj >= 6.6.0, < 8.6.3 8.6.3
Maven org.apache.solr:solr-core >= 6.6.0, < 8.6.3 8.6.3

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions. This issue is patched in 8.6.3.

References

External links from the advisory. They lead to third-party sites.