CVE-2020-13941 Information

Description

Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public) released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.htmlhttp-api-commands-for-the-replicationhandler) allows commands backup restore and deleteBackup. Each of these take a location parameter which was not validated i.e you could read/write to any location the solr user can access.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Reference

https://lists.apache.org/thread.html/rbcd9dff009ed19ffcc2b09784595fc1098fc802a5472f81795f893be@3Ccommits.lucene.apache.org3E https://lists.apache.org/thread.html/rf54e7912b7d2b72c63ec54a7afa4adcbf16268dcc63253767dd67d60403Cgeneral.lucene.apache.org3E

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.8