Description
Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands backup, restore and deleteBackup. Each of these take a location parameter, which was not validated, i.e you could read/write to any location the solr user can access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9Attack Vector: Network
Complexity: Low
Privileges: Low
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High
Affected Packages4 packages
🔴Vulnerability Details
4OSVImproper Input Validation in Apache Solr↗2022-02-10 GHSAImproper Input Validation in Apache Solr↗2022-02-10 OSVCVE-2020-13941: Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8↗2020-08-17 CVEListCVE-2020-13941: Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8↗2020-08-17 📋Vendor Advisories
2Red Hatsolr: replication handler allows a read-write operations to any location the solr user can access↗2020-08-17 DebianCVE-2020-13941: lucene-solr - Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in S...↗2020 💬Community
2BugzillaCVE-2020-13941 solr: replication handler allows a read-write operations to any location the solr user can access↗2020-08-17 BugzillaCVE-2020-13941 solr3: solr: replication handler allows a read-write operations to any location the solr user can access [fedora-31]↗2020-08-17