Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for

Summary

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.

Timeline

1. Oct 13, 2020, 6:28 PM UTCCVE published
2. Aug 4, 2024, 12:32 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a Apache Solr

  Version range not reported

• org.apache.solr:solr-parentMaven

  From 6.6.0 · fixed in 8.6.3

• org.apache.solr:solr-solrjMaven

  From 6.6.0 · fixed in 8.6.3

• org.apache.solr:solr-coreMaven

  From 6.6.0 · fixed in 8.6.3

References 23