Cyber Resilience

CVE-2020-13957

Access Control in Apache Solr 6.6.0 – 6.6.6

Published
13 October 2020
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.79 99.6th percentile
Risk Priority 97 floored blend · peak EPSS

Summary

CVE-2020-13957 is a critical-severity Incorrect Authorization (CWE-863) vulnerability in Apache Solr. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks…

more

in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.

CWE(s)

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
The CVE allows unauthenticated attackers to upload a malicious ConfigSet that bypasses dangerous-feature checks, enabling remote code execution via the Solr API.
T1059 Command and Scripting Interpreter Executionconfidence: MEDIUM
Successful exploitation can lead to arbitrary command execution on the Solr server through the uploaded ConfigSet.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-45216Same product: Apache Solr
CVE-2021-27905Same product: Apache Solr
CVE-2026-22022Same product: Apache Solr
CVE-2026-44825Same product: Apache Solr
CVE-2024-45217Same product: Apache Solr
CVE-2024-52012Same product: Apache Solr
CVE-2023-50386Same product: Apache Solr
CVE-2026-22444Same product: Apache Solr
CVE-2023-50290Same product: Apache Solr
CVE-2023-50292Same product: Apache Solr

Affected Assets

apache
solr
6.6.0 — 6.6.6 · 7.0.0 — 7.7.3 · 8.0.0 — 8.6.2

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 5 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-863

Periodic review and update of procedures reduces incorrect authorization implementations over time.

addresses: CWE-863

Supervision identifies cases where authorization logic incorrectly permits unauthorized actions.

addresses: CWE-863

Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.

addresses: CWE-863

The authorization process and usage restrictions help prevent incorrect authorization for remote access types.

addresses: CWE-863

Establishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access.

addresses: CWE-863

Establishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect.

addresses: CWE-863

Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.

addresses: CWE-863

Ensures authorization decisions for external system use are correctly implemented and enforced.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Defining, enforcing, and reviewing access authorizations and least privilege directly prevents incorrect authorization checks.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.

prevents

Enforcing policy-driven approval and role-change reviews stops incorrect or stale authorization decisions from remaining in effect after job changes or terminations.

prevents

By tying access rights to identity, device, location and classification, the control reduces the likelihood that an authorization decision will be based on an incorrect or bypassed policy.

References