{
  "@id": "urn:uuid:4b056829-7b11-409f-92fe-144ba270b3b7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T12:55:00.474182+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T22:17:48.370808+00:00",
      "status_notes": "Vulnerability CVE-2015-8795 does not affect version 5.5.5-tuxcare.4 of org.apache.solr:solr-core. not_affected \u2014 CVE-2015-8795 affects Apache Solr versions before 5.1. The target repository is Solr 5.5.5-tuxcare.4, which already contains the upstream fix (SOLR-7346) that escapes field names and type names using .esc() before inserting them into HTML. The fix was committed by Timothy Potter (thelabdude@apache.org) on April 6, 2015, and was included in the upstream Solr 5.5.5 release before TuxCare began ma...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-8795"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-8795 affects Apache Solr versions before 5.1. The target repository is Solr 5.5.5-tuxcare.4, which already contains the upstream fix (SOLR-7346) that escapes field names and type names using .esc() before inserting them into HTML. The fix was committed by Timothy Potter (thelabdude@apache.org) on April 6, 2015, and was included in the upstream Solr 5.5.5 release before TuxCare began ma..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T22:17:57.319556+00:00",
      "status_notes": "Vulnerability CVE-2015-8797 does not affect version 5.5.5-tuxcare.4 of org.apache.solr:solr-core. not_affected \u2014 The target repository (Apache Solr 5.5.5) is not affected by CVE-2015-8797 (XSS via unescaped entry parameter in Admin UI). The fix is already present at line 285 of solr/webapp/web/js/scripts/plugins.js, where user input is escaped via .esc() before being used in a jQuery selector. This fix was installed by upstream commit d275e5f847 (SOLR-7949), authored by Jan H\u00f8ydahl (janhoy@apache.org), wh...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-8797"
      },
      "impact_statement": "not_affected \u2014 The target repository (Apache Solr 5.5.5) is not affected by CVE-2015-8797 (XSS via unescaped entry parameter in Admin UI). The fix is already present at line 285 of solr/webapp/web/js/scripts/plugins.js, where user input is escaped via .esc() before being used in a jQuery selector. This fix was installed by upstream commit d275e5f847 (SOLR-7949), authored by Jan H\u00f8ydahl (janhoy@apache.org), wh..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2017-3163 does not affect version 5.5.5-tuxcare.4 of org.apache.solr:solr-core. The target repository (Apache Solr 5.5.5-tuxcare.4) is NOT AFFECTED by CVE-2017-3163. The upstream Apache fix for SOLR-10031 (commit ae789c2526) was already present in the upstream Solr 5.5.5 release that TuxCare onboarded. The fix adds validation to ReplicationHandler's filename parameters (FILE and CONF_FILE_SHORT) to prevent path traversal attacks by rejecting paths containing \"..\" and absolute paths. The validateFilenameOrError() method at lines 1349-1362 implements the defense that blocks the attack vector described in the CVE. The TLOG_FILE parameter mentioned in later patches does not exist in version 5.5.5, so there is no unpatched attack surface for that parameter in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.5.4; >= 6.0.0, < 6.4.1), NVD (<= 5.5.3; = 6.0.0; = 6.0.1; = 6.1.0; = 6.2.0; = 6.2.1; = 6.3.0; = 6.4.0), cve.org (>= 1.4.0, <= 5.5.3; >= 6.0.0, <= 6.4.0), Snyk (>= 1.4.0, < 5.5.4; >= 6.0.0, < 6.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-3163"
      },
      "impact_statement": "The target repository (Apache Solr 5.5.5-tuxcare.4) is NOT AFFECTED by CVE-2017-3163. The upstream Apache fix for SOLR-10031 (commit ae789c2526) was already present in the upstream Solr 5.5.5 release that TuxCare onboarded. The fix adds validation to ReplicationHandler's filename parameters (FILE and CONF_FILE_SHORT) to prevent path traversal attacks by rejecting paths containing \"..\" and absolute paths. The validateFilenameOrError() method at lines 1349-1362 implements the defense that blocks the attack vector described in the CVE. The TLOG_FILE parameter mentioned in later patches does not exist in version 5.5.5, so there is no unpatched attack surface for that parameter in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.5.4; >= 6.0.0, < 6.4.1), NVD (<= 5.5.3; = 6.0.0; = 6.0.1; = 6.1.0; = 6.2.0; = 6.2.1; = 6.3.0; = 6.4.0), cve.org (>= 1.4.0, <= 5.5.3; >= 6.0.0, <= 6.4.0), Snyk (>= 1.4.0, < 5.5.4; >= 6.0.0, < 6.4.1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-26T22:30:57.315053+00:00",
      "status_notes": "Vulnerability CVE-2017-3164 affects version 5.5.5-tuxcare.4 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2017-3164"
      },
      "action_statement": "Vulnerability CVE-2017-3164 affects version 5.5.5-tuxcare.4 of org.apache.solr:solr-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-26T22:30:57.315053+00:00",
      "status_notes": "Vulnerability CVE-2018-11802 is fixed in version 5.5.5-tuxcare.4 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2018-11802"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-26T22:30:57.315053+00:00",
      "status_notes": "Vulnerability CVE-2018-1308 is fixed in version 5.5.5-tuxcare.4 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2018-1308"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-26T22:30:57.315053+00:00",
      "status_notes": "Vulnerability CVE-2019-0192 is fixed in version 5.5.5-tuxcare.4 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2019-0192"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-26T22:30:57.315053+00:00",
      "status_notes": "Vulnerability CVE-2019-0193 is fixed in version 5.5.5-tuxcare.4 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2019-0193"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2019-12401 does not affect version 5.5.5-tuxcare.4 of org.apache.solr:solr-core. CVE-2019-12401 describes an XML entity expansion attack (Billion Laughs/Lol Bomb) affecting Solr versions prior to 5.0.0. The target repository is Solr 5.5.5-tuxcare.4, which already contains the fix: Woodstox XML parser upgraded from 3.2.7 to 4.4.1. This upgrade was performed by upstream Apache (commit 1744f84b71, author ab@apache.org) in January 2015, before Solr 5.0.0 was released, and was already present in the upstream release that TuxCare onboarded. The fix provides built-in limits on entity expansion to prevent resource exhaustion. Verdict: not_affected (upstream fix shipped in the release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.0.0), NVD (>= 1.3.0, <= 1.4.1; >= 3.1, <= 3.6.2; >= 4.0.0, <= 4.10.4), cve.org (>= 1.3.0, <= 1.4.1; >= 3.1.0, <= 3.6.2; >= 4.0.0, <= 4.10.4), Snyk (< 5.0.0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12401"
      },
      "impact_statement": "CVE-2019-12401 describes an XML entity expansion attack (Billion Laughs/Lol Bomb) affecting Solr versions prior to 5.0.0. The target repository is Solr 5.5.5-tuxcare.4, which already contains the fix: Woodstox XML parser upgraded from 3.2.7 to 4.4.1. This upgrade was performed by upstream Apache (commit 1744f84b71, author ab@apache.org) in January 2015, before Solr 5.0.0 was released, and was already present in the upstream release that TuxCare onboarded. The fix provides built-in limits on entity expansion to prevent resource exhaustion. Verdict: not_affected (upstream fix shipped in the release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.0.0), NVD (>= 1.3.0, <= 1.4.1; >= 3.1, <= 3.6.2; >= 4.0.0, <= 4.10.4), cve.org (>= 1.3.0, <= 1.4.1; >= 3.1.0, <= 3.6.2; >= 4.0.0, <= 4.10.4), Snyk (< 5.0.0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-26T22:30:57.315053+00:00",
      "status_notes": "Vulnerability CVE-2019-12409 does not affect version 5.5.5-tuxcare.4 of org.apache.solr:solr-core. already_fixed \u2014 CVE-2019-12409 is NOT present in the target. The target repository (Apache Solr 5.5.5) contains a fix that was applied in 2014 via SOLR-6843 (commit c081ddad4c), which sets ENABLE_REMOTE_JMX_OPTS to 'false' by default, preventing unauthenticated remote JMX access. Although the CVE description mentions versions 8.1.1 and 8.2.0 as affected (suggesting the vulnerability was re-introduced in those ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12409"
      },
      "impact_statement": "already_fixed \u2014 CVE-2019-12409 is NOT present in the target. The target repository (Apache Solr 5.5.5) contains a fix that was applied in 2014 via SOLR-6843 (commit c081ddad4c), which sets ENABLE_REMOTE_JMX_OPTS to 'false' by default, preventing unauthenticated remote JMX access. Although the CVE description mentions versions 8.1.1 and 8.2.0 as affected (suggesting the vulnerability was re-introduced in those ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-26T22:30:57.315053+00:00",
      "status_notes": "Vulnerability CVE-2019-17558 is fixed in version 5.5.5-tuxcare.4 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2019-17558"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-10T09:12:00.042647+00:00",
      "status_notes": "Vulnerability CVE-2020-13957 does not affect version 5.5.5-tuxcare.4 of org.apache.solr:solr-core. Version 5.5.5 is not affected by CVE-2020-13957. The vulnerability requires the UPLOAD ConfigSet API action (introduced in Solr 6.6.0+) to be exploited through a combination of UPLOAD/CREATE operations. Version 5.5.5 predates this feature entirely\u2014only CREATE, DELETE, and LIST actions exist in the ConfigSetAction enum. Additionally, 5.5.5 lacks the ConfigSet trust/authentication security mechanism (introduced in 6.6.0+) that this CVE exploits. Without the UPLOAD functionality or trust mechanism, the specific attack vector described in CVE-2020-13957 cannot be executed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13957"
      },
      "impact_statement": "Version 5.5.5 is not affected by CVE-2020-13957. The vulnerability requires the UPLOAD ConfigSet API action (introduced in Solr 6.6.0+) to be exploited through a combination of UPLOAD/CREATE operations. Version 5.5.5 predates this feature entirely\u2014only CREATE, DELETE, and LIST actions exist in the ConfigSetAction enum. Additionally, 5.5.5 lacks the ConfigSet trust/authentication security mechanism (introduced in 6.6.0+) that this CVE exploits. Without the UPLOAD functionality or trust mechanism, the specific attack vector described in CVE-2020-13957 cannot be executed."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-26T22:30:57.315053+00:00",
      "status_notes": "Vulnerability CVE-2021-29262 affects version 5.5.5-tuxcare.4 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2021-29262"
      },
      "action_statement": "Vulnerability CVE-2021-29262 affects version 5.5.5-tuxcare.4 of org.apache.solr:solr-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2023-50291 affects version 5.5.5-tuxcare.4 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2023-50291"
      },
      "action_statement": "Vulnerability CVE-2023-50291 affects version 5.5.5-tuxcare.4 of org.apache.solr:solr-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2023-50292 affects version 5.5.5-tuxcare.4 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2023-50292"
      },
      "action_statement": "Vulnerability CVE-2023-50292 affects version 5.5.5-tuxcare.4 of org.apache.solr:solr-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2023-50386 affects version 5.5.5-tuxcare.4 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2023-50386"
      },
      "action_statement": "Vulnerability CVE-2023-50386 affects version 5.5.5-tuxcare.4 of org.apache.solr:solr-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T12:55:00.474182+00:00",
      "status_notes": "Vulnerability CVE-2024-45216 affects version 5.5.5-tuxcare.4 of org.apache.solr:solr-core, and is fixed in 5.5.5-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2024-45216"
      },
      "action_statement": "Vulnerability CVE-2024-45216 affects version 5.5.5-tuxcare.4 of org.apache.solr:solr-core, and is fixed in 5.5.5-tuxcare.6."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T19:42:00.228528+00:00",
      "status_notes": "Vulnerability CVE-2024-52012 does not affect version 5.5.5-tuxcare.4 of org.apache.solr:solr-core. not_affected \u2014 Apache Solr 5.5.5 is not affected by CVE-2024-52012. The vulnerability exists in FileSystemConfigSetService.uploadFileToConfig() method which was introduced in version 6.6. Version 5.5.5 uses a completely different architecture - ZooKeeper-only configset storage with no filesystem-based upload API. The ConfigSetParams enum in this version only supports CREATE, DELETE, and LIST actions; there is...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52012"
      },
      "impact_statement": "not_affected \u2014 Apache Solr 5.5.5 is not affected by CVE-2024-52012. The vulnerability exists in FileSystemConfigSetService.uploadFileToConfig() method which was introduced in version 6.6. Version 5.5.5 uses a completely different architecture - ZooKeeper-only configset storage with no filesystem-based upload API. The ConfigSetParams enum in this version only supports CREATE, DELETE, and LIST actions; there is..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-26T22:32:15.041749+00:00",
      "status_notes": "Vulnerability CVE-2025-24814 is fixed in version 5.5.5-tuxcare.4 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2025-24814"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-26T22:30:57.315053+00:00",
      "status_notes": "Vulnerability CVE-2026-22022 is fixed in version 5.5.5-tuxcare.4 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2026-22022"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@5.5.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2026-22444 affects version 5.5.5-tuxcare.4 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2026-22444"
      },
      "action_statement": "Vulnerability CVE-2026-22444 affects version 5.5.5-tuxcare.4 of org.apache.solr:solr-core."
    }
  ]
}