Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered
    dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded
    via API without authentication/authorization. The checks in place to prevent such features can be
    circumvented by using a combination of UPLOAD/CREATE actions. (CVE-2020-13957)

The version of Apache Solr running on the remote host is 6.6.x prior to 6.6.7, or 7.x prior to 7.7.4, or 8.x prior to 8.6.3. It is, therefore, affected by an authentication bypass vulnerability. Apache Solr prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
409451	SCA: security update for org.apache.solr:solr-core, org.apache.solr:solr-parent, org.apache.solr:solr-solrj (GHSA-3c7p-vv5r-cmr5)	Tenable Cloud Security	SCA Checks	critical
409451	SCA: security update for org.apache.solr:solr-core, org.apache.solr:solr-parent, org.apache.solr:solr-solrj (GHSA-3c7p-vv5r-cmr5)	Tenable Self-Hosted Container Security	SCA Checks	critical
181480	Apache Solr 6.6.x < 6.6.7 / 7.x < 7.7.4 / 8.x < 8.6.3 Authentication Bypass (CVE-2020-13957)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2020-13957

critical

Tenable Plugins

critical

critical

critical