Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Expand GitLab format information about score and CVSS vector #6574

Open
marwin1991 opened this issue Apr 10, 2024 · 0 comments
Open

Expand GitLab format information about score and CVSS vector #6574

marwin1991 opened this issue Apr 10, 2024 · 0 comments

Comments

@marwin1991
Copy link

Currently GitLab format doesn't provide information about score and CVSS vector but JUNIT format does.

JUNIT:

<testcase classname="CVE-2022-46364" name="pkg:maven/org.apache.cxf/cxf-rt-wsdl@3.4.4">
<failure message="cvssV3: CRITICAL, score: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A)"/>
<system-out>A SSRF vulnerability in parsing the��href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.��</system-out>
<system-err>location: /builds/softnet/p31/eBankNet/.m2/repository/org/apache/cxf/cxf-rt-wsdl/3.4.4/cxf-rt-wsdl-3.4.4.jar, project-references: [ dbts:compile ]</system-err>
</testcase>

GitLab has introduced CVSS_VECTOR in format:

https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/commit/03a58b32e9d2c43d45934fbe750ef4580aa7a3f6

IMO we should expand description section about message same as in JUNIT and add CVSS_VECTOR

Ref:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant