Vulnerability record · CVE-2020-13957 · published 13 October 2020
CVE-2020-13957: Apache Solr ConfigSet upload authorization bypass enabling RCE
Apache · Solr
Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 block dangerous ConfigSet features that could lead to remote code execution when uploaded via API without authentication, but those checks can be bypassed using a combination of UPLOAD and CREATE actions. This is an incorrect authorization flaw (CWE-863) that lets an unauthenticated attacker defeat the intended safeguard and configure Solr in ways that enable code execution.
Description
Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or user interaction required and a very high EPSS score make this a top-priority patch despite no KEV listing.
What it is
Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 block dangerous ConfigSet features that could lead to remote code execution when uploaded via API without authentication, but those checks can be bypassed using a combination of UPLOAD and CREATE actions. This is an incorrect authorization flaw (CWE-863) that lets an unauthenticated attacker defeat the intended safeguard and configure Solr in ways that enable code execution.
Impact
An attacker can bypass the ConfigSet safety checks and configure features that lead to remote code execution on the Solr server. Given the CVSS vector (C:H/I:H/A:H), full compromise of confidentiality, integrity and availability is possible.
Attack surface
Reached over the network via the Solr ConfigSet API using UPLOAD and CREATE actions; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no reference is tagged as an exploit, but EPSS is very high (0.79342, 99.58th percentile), indicating elevated likelihood of exploitation activity.
What to do
- Upgrade Apache Solr to a version outside the affected ranges (6.6.0-6.6.6, 7.0.0-7.7.3, 8.0.0-8.6.2) as the primary fix.
- Restrict network access to the Solr API so only trusted hosts can reach it; do not expose Solr directly to untrusted networks.
- Enable authentication and authorization on the Solr API so ConfigSet UPLOAD/CREATE actions require credentials.
- Audit and remove any ConfigSets that were uploaded unexpectedly or contain dangerous configuration features.
- Monitor Solr logs for UPLOAD and CREATE ConfigSet API calls from unexpected sources.
Detection
- Search Solr request logs for ConfigSet UPLOAD and CREATE API calls, especially from unauthenticated or unexpected clients.
- Alert on ConfigSet uploads that introduce dangerous configuration features or reference external code.
- Baseline the set of legitimate ConfigSets and alert on new or modified ConfigSets outside change windows.
- Monitor for post-exploitation behavior such as unexpected processes or outbound connections from Solr hosts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-13957 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-13957), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
