Security Bulletin: A security bypass vulnerability in Apache Solr (lucene) affects IBM InfoSphere Information Server

Summary

A security bypass vulnerability in Apache Solr (lucene) used by IBM InfoSphere Information Server was addressed.

Vulnerability Details

CVEID:CVE-2020-13957
**DESCRIPTION:**Apache Solr could allow a remote attacker to bypass security restrictions, caused by improper access control by the Configsets API. By using a combination of UPLOAD/CREATE actions, an attacker could exploit this vulnerability to bypass the checking mechanism for features considered as dangerous.
CVSS Base score: 9.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/189644 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L)

Affected Products and Versions

Remediation/Fixes

Otherwise, follow the steps in the “Solr cloud (admin UI authentication)” section of Technote.

InfoSphere Information Analyzer, InfoSphere Data Quality Exception Console, Information Server on Cloud | 11.5 | None
| --Follow the steps in the “Solr cloud (admin UI authentication)” section of Technote.

Workarounds and Mitigations

If you don’t have a Microservices tier, follow the steps in the “Solr cloud (admin UI authentication)” section of Technote.