Skip to content

Bad parsing of CVSS for OSS Index issues #5019

@vmeurisse

Description

@vmeurisse

Describe the bug
When reporting issue sonatype-2020-0739, Dependency Check parses it as CVSS2 with missing fields while the sonatype shows a CVSS 3.1 with all the fields present.

The json produced contains:

"cvssv2": {
    "score": 9.8,
    "accessVector": "N",
    "accessComplexity": "L",
    "authenticationr": "$enc.json($vuln.cvssV2.authentication)",
    "confidentialImpact": "H",
    "integrityImpact": "H",
    "availabilityImpact": "H",
    "severity": "HIGH"
},

Version of dependency-check used
The problem occurs using version 7.3.0 of the cli

Log file
https://files.meurisse.org/depcheck.log

To Reproduce
Steps to reproduce the behavior:

  1. Create an empty folder
  2. Inside, run the command npm init && npm i [email protected]
  3. Run dependency-check.sh --project test -s . --log test.log
  4. Inspect the generated JSON

Expected behavior
The json should contain something like:

"cvssv3": {
    "baseScore": 9.8,
    "attackVector": "NETWORK",
    "attackComplexity": "LOW",
    "privilegesRequired": "NONE",
    "userInteraction": "NONE",
    "scope": "UNCHANGED",
    "confidentialityImpact": "HIGH",
    "integrityImpact": "HIGH",
    "availabilityImpact": "HIGH",
    "baseSeverity": "HIGH",
    "exploitabilityScore": "3.9",
    "impactScore": "5.9",
    "version": "3.1"
},

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions