{
  "@id": "urn:uuid:d34ef088-33f9-4944-b162-5c8a94ad07fe",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T13:34:35.728691+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2015-8795 does not affect version 7.7.3-tuxcare.1 of org.apache.solr:solr-core. not_affected \u2014 CVE-2015-8795 is not present in Apache Solr 7.7.3. The vulnerability (XSS via unescaped field/type names in Admin UI) affected Solr versions before 5.1. The target version (7.7.3) contains the upstream fix from commit a0c4e5186e (April 2015, by Timothy Potter), which was already included in the upstream 7.7.3 release that TuxCare onboarded. Additionally, the entire Admin UI was rewritten using ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-8795"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-8795 is not present in Apache Solr 7.7.3. The vulnerability (XSS via unescaped field/type names in Admin UI) affected Solr versions before 5.1. The target version (7.7.3) contains the upstream fix from commit a0c4e5186e (April 2015, by Timothy Potter), which was already included in the upstream 7.7.3 release that TuxCare onboarded. Additionally, the entire Admin UI was rewritten using ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2015-8797 does not affect version 7.7.3-tuxcare.1 of org.apache.solr:solr-core. not_affected \u2014 The target version (Solr 7.7.3) is not affected by CVE-2015-8797. The vulnerable jQuery-based Admin UI has been completely replaced with an Angular-based architecture. The vulnerable pattern (constructing jQuery selectors with unsanitized user input like `$('a[data-bean=\"' + entries[i] + '\"]')`) does not exist in the target. While the entry parameter is still received at solr/webapp/web/js/angu...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2015-8797"
      },
      "impact_statement": "not_affected \u2014 The target version (Solr 7.7.3) is not affected by CVE-2015-8797. The vulnerable jQuery-based Admin UI has been completely replaced with an Angular-based architecture. The vulnerable pattern (constructing jQuery selectors with unsanitized user input like `$('a[data-bean=\"' + entries[i] + '\"]')`) does not exist in the target. While the entry parameter is still received at solr/webapp/web/js/angu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2017-3163 does not affect version 7.7.3-tuxcare.1 of org.apache.solr:solr-core. CVE-2017-3163 (path traversal in Solr ReplicationHandler) is NOT present in target version 7.7.3. The fix (SOLR-10031) that adds validateFilenameOrError() validation was already included in the upstream Apache Solr 7.7.3 release before TuxCare onboarded it. The method validates all three filename parameters (FILE, CONF_FILE_SHORT, TLOG_FILE) by rejecting \"..\" path components and absolute paths, preventing directory traversal attacks. CVE affects Solr before 5.5.4 and 6.x before 6.4.1; version 7.7.3 is well beyond the affected range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.5.4; >= 6.0.0, < 6.4.1), NVD (<= 5.5.3; = 6.0.0; = 6.0.1; = 6.1.0; = 6.2.0; = 6.2.1; = 6.3.0; = 6.4.0), cve.org (>= 1.4.0, <= 5.5.3; >= 6.0.0, <= 6.4.0), Snyk (>= 1.4.0, < 5.5.4; >= 6.0.0, < 6.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-3163"
      },
      "impact_statement": "CVE-2017-3163 (path traversal in Solr ReplicationHandler) is NOT present in target version 7.7.3. The fix (SOLR-10031) that adds validateFilenameOrError() validation was already included in the upstream Apache Solr 7.7.3 release before TuxCare onboarded it. The method validates all three filename parameters (FILE, CONF_FILE_SHORT, TLOG_FILE) by rejecting \"..\" path components and absolute paths, preventing directory traversal attacks. CVE affects Solr before 5.5.4 and 6.x before 6.4.1; version 7.7.3 is well beyond the affected range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.5.4; >= 6.0.0, < 6.4.1), NVD (<= 5.5.3; = 6.0.0; = 6.0.1; = 6.1.0; = 6.2.0; = 6.2.1; = 6.3.0; = 6.4.0), cve.org (>= 1.4.0, <= 5.5.3; >= 6.0.0, <= 6.4.0), Snyk (>= 1.4.0, < 5.5.4; >= 6.0.0, < 6.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2017-3164 does not affect version 7.7.3-tuxcare.1 of org.apache.solr:solr-core. CVE-2017-3164 (SSRF via unvalidated 'shards' parameter) is NOT present in Apache Solr 7.7.3. The fix (SOLR-12770) introducing the WhitelistHostChecker mechanism was already included in the upstream 7.7.3 release. The vulnerable pattern (unrestricted HTTP requests to arbitrary URLs via the shards parameter) does not exist because all shard URLs are validated against a whitelist (explicit configuration or live cluster nodes). Whitelist checking is enabled by default and enforced with a FORBIDDEN error in non-cloud mode without explicit configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 7.7.0), NVD (>= 1.3.0, <= 7.6.0), cve.org (>= 1.3.0, <= 1.4.1; >= 3.1.0, <= 3.6.2; >= 4.0.0, <= 4.10.4; >= 5.0.0, <= 5.5.5; >= 6.0.0, <= 6.6.5; >= 7.0.0, <= 7.6.0), Snyk (>= 1.3.0, < 7.6.0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-3164"
      },
      "impact_statement": "CVE-2017-3164 (SSRF via unvalidated 'shards' parameter) is NOT present in Apache Solr 7.7.3. The fix (SOLR-12770) introducing the WhitelistHostChecker mechanism was already included in the upstream 7.7.3 release. The vulnerable pattern (unrestricted HTTP requests to arbitrary URLs via the shards parameter) does not exist because all shard URLs are validated against a whitelist (explicit configuration or live cluster nodes). Whitelist checking is enabled by default and enforced with a FORBIDDEN error in non-cloud mode without explicit configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 7.7.0), NVD (>= 1.3.0, <= 7.6.0), cve.org (>= 1.3.0, <= 1.4.1; >= 3.1.0, <= 3.6.2; >= 4.0.0, <= 4.10.4; >= 5.0.0, <= 5.5.5; >= 6.0.0, <= 6.6.5; >= 7.0.0, <= 7.6.0), Snyk (>= 1.3.0, < 7.6.0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2018-11802 does not affect version 7.7.3-tuxcare.1 of org.apache.solr:solr-core. not_affected \u2014 CVE-2018-11802 (SOLR-12514) is NOT present in target version 7.7.3. The vulnerability involved bypassing authorization when a Solr node proxies requests to another node for collections it doesn't host. The fix was included in upstream Apache Solr 7.7.0 (released before 7.7.3) and authored by noble@apache.org. The fix preserves authentication context (user principal) in SolrRequestInfo before pr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11802"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11802 (SOLR-12514) is NOT present in target version 7.7.3. The vulnerability involved bypassing authorization when a Solr node proxies requests to another node for collections it doesn't host. The fix was included in upstream Apache Solr 7.7.0 (released before 7.7.3) and authored by noble@apache.org. The fix preserves authentication context (user principal) in SolrRequestInfo before pr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2018-1308 does not affect version 7.7.3-tuxcare.1 of org.apache.solr:solr-core. Apache Solr 7.7.3 is not affected by CVE-2018-1308 (XXE in DataImportHandler's dataConfig parameter). The upstream fix was already present in the 7.7.3 release before TuxCare onboarded it. The fix blocks XXE attacks by using EmptyEntityResolver.SAX_INSTANCE when XML comes from request parameters without a systemId, preventing external entity resolution and file access.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.2, < 6.6.3; >= 7.0.0, < 7.3.0), NVD (>= 1.2, <= 6.6.2; >= 7.0.0, <= 7.2.1), cve.org (>= 1.2, <= 6.6.2; >= 7.0.0, <= 7.2.1), Snyk (< 6.6.3; >= 7.0.0, < 7.3.0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1308"
      },
      "impact_statement": "Apache Solr 7.7.3 is not affected by CVE-2018-1308 (XXE in DataImportHandler's dataConfig parameter). The upstream fix was already present in the 7.7.3 release before TuxCare onboarded it. The fix blocks XXE attacks by using EmptyEntityResolver.SAX_INSTANCE when XML comes from request parameters without a systemId, preventing external entity resolution and file access.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.2, < 6.6.3; >= 7.0.0, < 7.3.0), NVD (>= 1.2, <= 6.6.2; >= 7.0.0, <= 7.2.1), cve.org (>= 1.2, <= 6.6.2; >= 7.0.0, <= 7.2.1), Snyk (< 6.6.3; >= 7.0.0, < 7.3.0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2019-0192 does not affect version 7.7.3-tuxcare.1 of org.apache.solr:solr-core. Version 7.7.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-xhcq-fv7x-grr2 (affected below 7.0.0), NVD (affected up to 6.6.5), CVE record (affected up to 6.6.5), Snyk (affected below 7.0.0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0192"
      },
      "impact_statement": "Version 7.7.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-xhcq-fv7x-grr2 (affected below 7.0.0), NVD (affected up to 6.6.5), CVE record (affected up to 6.6.5), Snyk (affected below 7.0.0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2019-0193 does not affect version 7.7.3-tuxcare.1 of org.apache.solr:solr-core. The target Apache Solr 7.7.3 is not affected by CVE-2019-0193. The vulnerability (arbitrary code execution via scripts in the DataImportHandler's dataConfig request parameter) was fixed in upstream Apache Solr and included in the 7.7.3 release. Two defense mechanisms are present: (1) DataImportHandler.java blocks the dataConfig parameter by default unless system property enable.dih.dataConfigParam=true is set, and (2) DataImporter.java prevents XXE attacks via EmptyEntityResolver. Both fixes were authored by Apache committers (houston@apache.org for SOLR-13669, uschindler@apache.org for SOLR-11971) and are ancestors of the first TuxCare onboard commit, confirming they shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0193"
      },
      "impact_statement": "The target Apache Solr 7.7.3 is not affected by CVE-2019-0193. The vulnerability (arbitrary code execution via scripts in the DataImportHandler's dataConfig request parameter) was fixed in upstream Apache Solr and included in the 7.7.3 release. Two defense mechanisms are present: (1) DataImportHandler.java blocks the dataConfig parameter by default unless system property enable.dih.dataConfigParam=true is set, and (2) DataImporter.java prevents XXE attacks via EmptyEntityResolver. Both fixes were authored by Apache committers (houston@apache.org for SOLR-13669, uschindler@apache.org for SOLR-11971) and are ancestors of the first TuxCare onboard commit, confirming they shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2019-12401 does not affect version 7.7.3-tuxcare.1 of org.apache.solr:solr-core. CVE-2019-12401 affects Apache Solr versions prior to 5.0.0 and concerns XML entity expansion attacks (billion laughs/XML bomb) via the update handler. The target (Solr 7.7.3) is not affected because the fix was already present in the upstream Apache Solr 7.7.3 release. The fix upgraded the Woodstox XML parser from version 3.2.7 (vulnerable) to 4.4.1 (protected) in January 2015, well before the 7.7.3 release. The vulnerable Woodstox 3.2.7 code is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.0.0), NVD (>= 1.3.0, <= 1.4.1; >= 3.1, <= 3.6.2; >= 4.0.0, <= 4.10.4), cve.org (>= 1.3.0, <= 1.4.1; >= 3.1.0, <= 3.6.2; >= 4.0.0, <= 4.10.4), Snyk (< 5.0.0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12401"
      },
      "impact_statement": "CVE-2019-12401 affects Apache Solr versions prior to 5.0.0 and concerns XML entity expansion attacks (billion laughs/XML bomb) via the update handler. The target (Solr 7.7.3) is not affected because the fix was already present in the upstream Apache Solr 7.7.3 release. The fix upgraded the Woodstox XML parser from version 3.2.7 (vulnerable) to 4.4.1 (protected) in January 2015, well before the 7.7.3 release. The vulnerable Woodstox 3.2.7 code is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.0.0), NVD (>= 1.3.0, <= 1.4.1; >= 3.1, <= 3.6.2; >= 4.0.0, <= 4.10.4), cve.org (>= 1.3.0, <= 1.4.1; >= 3.1.0, <= 3.6.2; >= 4.0.0, <= 4.10.4), Snyk (< 5.0.0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2019-12409 does not affect version 7.7.3-tuxcare.1 of org.apache.solr:solr-core. Apache Solr 7.7.3 is NOT affected by CVE-2019-12409. The vulnerability (insecure default JMX configuration enabling remote access without authentication) was introduced in April 2019 via commit 7fd49c3228 (SOLR-12461) and only affected versions 8.1.1 and 8.2.0. Version 7.7.3 has a secure default configuration (#ENABLE_REMOTE_JMX_OPTS=\"false\") established by SOLR-7580 (Oct 2016, commit 8ae3304c86) and never received the vulnerability-introducing commit, which was only applied to the 8.x branch. The vulnerable configuration pattern has never existed in the 7.7.3 codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12409"
      },
      "impact_statement": "Apache Solr 7.7.3 is NOT affected by CVE-2019-12409. The vulnerability (insecure default JMX configuration enabling remote access without authentication) was introduced in April 2019 via commit 7fd49c3228 (SOLR-12461) and only affected versions 8.1.1 and 8.2.0. Version 7.7.3 has a secure default configuration (#ENABLE_REMOTE_JMX_OPTS=\"false\") established by SOLR-7580 (Oct 2016, commit 8ae3304c86) and never received the vulnerability-introducing commit, which was only applied to the 8.x branch. The vulnerable configuration pattern has never existed in the 7.7.3 codebase."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2019-17558 does not affect version 7.7.3-tuxcare.1 of org.apache.solr:solr-core. CVE-2019-17558 affects Apache Solr 5.0.0 through 8.3.1 via Remote Code Execution through VelocityResponseWriter. The target (Solr 7.7.3) is NOT AFFECTED because upstream Apache backported comprehensive security fixes (SOLR-13971 and SOLR-14025) to the 7.7.3 release in April 2020. These fixes were already present when TuxCare onboarded version 7.7.3. The defenses include: (1) params resource loader completely removed, (2) template rendering restricted to trusted configsets only via isConfigSetTrusted() checks, and (3) SecureUberspector installed to block access to dangerous Java classes (Runtime, System, Process, ClassLoader, etc.). The vulnerable code pattern is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17558"
      },
      "impact_statement": "CVE-2019-17558 affects Apache Solr 5.0.0 through 8.3.1 via Remote Code Execution through VelocityResponseWriter. The target (Solr 7.7.3) is NOT AFFECTED because upstream Apache backported comprehensive security fixes (SOLR-13971 and SOLR-14025) to the 7.7.3 release in April 2020. These fixes were already present when TuxCare onboarded version 7.7.3. The defenses include: (1) params resource loader completely removed, (2) template rendering restricted to trusted configsets only via isConfigSetTrusted() checks, and (3) SecureUberspector installed to block access to dangerous Java classes (Runtime, System, Process, ClassLoader, etc.). The vulnerable code pattern is not present in the target."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:35.728691+00:00",
      "status_notes": "Vulnerability CVE-2020-13957 is fixed in version 7.7.3-tuxcare.1 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2020-13957"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2021-29262 affects version 7.7.3-tuxcare.1 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2021-29262"
      },
      "action_statement": "Vulnerability CVE-2021-29262 affects version 7.7.3-tuxcare.1 of org.apache.solr:solr-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2023-50291 affects version 7.7.3-tuxcare.1 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2023-50291"
      },
      "action_statement": "Vulnerability CVE-2023-50291 affects version 7.7.3-tuxcare.1 of org.apache.solr:solr-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2023-50292 does not affect version 7.7.3-tuxcare.1 of org.apache.solr:solr-core. Apache Solr version 7.7.3 is not affected by CVE-2023-50292. The vulnerability concerns the Schema Designer feature, which was introduced in version 8.10.0 (commit 5768e5ab9a, July 30, 2021). Version 7.7.3 predates this feature by multiple years. No SchemaDesigner classes, API endpoints, or handler directories exist in the target codebase. The vulnerable code pattern (SchemaDesigner loading untrusted configSets with hardcoded trusted=true) cannot occur without the feature itself. This is a Type A1 case: the INPUT (HTTP requests to Schema Designer endpoints) is not received anywhere in version 7.7.3.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-50292"
      },
      "impact_statement": "Apache Solr version 7.7.3 is not affected by CVE-2023-50292. The vulnerability concerns the Schema Designer feature, which was introduced in version 8.10.0 (commit 5768e5ab9a, July 30, 2021). Version 7.7.3 predates this feature by multiple years. No SchemaDesigner classes, API endpoints, or handler directories exist in the target codebase. The vulnerable code pattern (SchemaDesigner loading untrusted configSets with hardcoded trusted=true) cannot occur without the feature itself. This is a Type A1 case: the INPUT (HTTP requests to Schema Designer endpoints) is not received anywhere in version 7.7.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2023-50386 affects version 7.7.3-tuxcare.1 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2023-50386"
      },
      "action_statement": "Vulnerability CVE-2023-50386 affects version 7.7.3-tuxcare.1 of org.apache.solr:solr-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:35.728691+00:00",
      "status_notes": "Vulnerability CVE-2024-45216 is fixed in version 7.7.3-tuxcare.1 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2024-45216"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2024-45217 affects version 7.7.3-tuxcare.1 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2024-45217"
      },
      "action_statement": "Vulnerability CVE-2024-45217 affects version 7.7.3-tuxcare.1 of org.apache.solr:solr-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2024-52012 does not affect version 7.7.3-tuxcare.1 of org.apache.solr:solr-core. not_affected \u2014 Version 7.7.3 is not affected by CVE-2024-52012. The vulnerability requires FileSystemConfigSetService.uploadFileToConfig(), which does not exist in this version. Solr 7.7.3 only supports ZooKeeper-based configset upload (CloudConfigSetService), which writes to ZooKeeper storage, not to the filesystem. The CVE describes arbitrary filepath write-access during configset upload, but version 7.7.3'...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52012"
      },
      "impact_statement": "not_affected \u2014 Version 7.7.3 is not affected by CVE-2024-52012. The vulnerability requires FileSystemConfigSetService.uploadFileToConfig(), which does not exist in this version. Solr 7.7.3 only supports ZooKeeper-based configset upload (CloudConfigSetService), which writes to ZooKeeper storage, not to the filesystem. The CVE describes arbitrary filepath write-access during configset upload, but version 7.7.3'..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2025-24814 affects version 7.7.3-tuxcare.1 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2025-24814"
      },
      "action_statement": "Vulnerability CVE-2025-24814 affects version 7.7.3-tuxcare.1 of org.apache.solr:solr-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:35.728691+00:00",
      "status_notes": "Vulnerability CVE-2026-22022 is fixed in version 7.7.3-tuxcare.1 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2026-22022"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.solr/solr-core@7.7.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T13:34:05.366718+00:00",
      "status_notes": "Vulnerability CVE-2026-22444 affects version 7.7.3-tuxcare.1 of org.apache.solr:solr-core.",
      "vulnerability": {
        "name": "CVE-2026-22444"
      },
      "action_statement": "Vulnerability CVE-2026-22444 affects version 7.7.3-tuxcare.1 of org.apache.solr:solr-core."
    }
  ]
}