GHSA-3c7p-vv5r-cmr5 · Severity: critical · Ecosystem: maven — Incorrect Authorization in Apache Solr
Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.
Conclusion & alert: CVE-2020-13957 is rated High Risk (73.4/100): CVSS Critical severity, with high exploitation likelihood (EPSS 84.82%, 99th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-03-26 | 85.39% | 84.82% | -0.56% |
| 2 | 2026-03-21 | 84.82% | 85.39% | +0.56% |
| 3 | 2026-03-04 | — | 84.82% | — |
Full EPSS history (43 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.8 | 3.1 | CRITICAL |
|
3.9 | 5.9 | [email protected] |
| 7.5 | 2.0 | HIGH |
|
10.0 | 6.4 | [email protected] |
GHSA-3c7p-vv5r-cmr5 · Severity: critical · Ecosystem: maven — Incorrect Authorization in Apache Solr
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
unimportant | CVE-2020-13957 unimportant priority: Debian including 1 source packages (lucene-solr), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2020-13957 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2020-13957 |
ubuntu
|
medium | CVE-2020-13957 medium priority: Ubuntu including 1 source packages (lucene-solr), 5 status rows across 5 suites (bionic, focal, trusty, upstream, xenial): not-affected 5. | https://ubuntu.com/security/CVE-2020-13957 |