CVE-2020-13941

Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands backup, restore and deleteBackup. Each of these take a location parameter, which was not validated, i.e you could read/write to any location the solr user can access.

• CWE-20

• https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/rbcd9dff009ed19ffcc2b09784595fc1098fc802a5472f81795f893be%40%3Ccommits.lucene.apache.org%3E
• https://lists.apache.org/thread.html/rc400db37710ee79378b6c52de3640493ff538c2beb41cefdbbdf2ab8%40%3Ccommits.submarine.apache.org%3E
• https://lists.apache.org/thread.html/rf54e7912b7d2b72c63ec54a7afa4adcbf16268dcc63253767dd67d60%40%3Cgeneral.lucene.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/rbcd9dff009ed19ffcc2b09784595fc1098fc802a5472f81795f893be%40%3Ccommits.lucene.apache.org%3E
• https://lists.apache.org/thread.html/rc400db37710ee79378b6c52de3640493ff538c2beb41cefdbbdf2ab8%40%3Ccommits.submarine.apache.org%3E
• https://lists.apache.org/thread.html/rf54e7912b7d2b72c63ec54a7afa4adcbf16268dcc63253767dd67d60%40%3Cgeneral.lucene.apache.org%3EMailing List, Vendor Advisory

Published

Aug 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13936An attacker that is able to modify Velocity templates may ex…8.8
• CVE-2020-13937Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0…5.3
• CVE-2020-13938Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged loc…5.5
• CVE-2020-13939Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-1394An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2020-13940In Apache NiFi 1.0.0 to 1.11.4, the notification service man…5.5
• CVE-2020-13942It is possible to inject malicious OGNL or MVEL scripts into…9.8
• CVE-2020-13943If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to…4.3
• CVE-2020-13944In Apache Airflow < 1.10.12, the "origin" parameter passed t…6.1
• CVE-2020-13945In Apache APISIX, the user enabled the Admin API and deleted…6.5
• CVE-2020-13946In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3…5.9
• CVE-2020-13947An instance of a cross-site scripting vulnerability was iden…6.1