Skip to content

CWE missing for NPM Audit vulnerabilities #5551

@aikebah

Description

@aikebah

Describe the bug
For NPM Audit results that have CWE data in the Audit API response the CWE is missing on the dependency-check reports

Version of dependency-check used
The problem occurs using version 8.1.2

To Reproduce
Steps to reproduce the behavior:

  1. Create an npm project depending on [email protected]
  2. Run dependencyCheck
  3. Observe that CWE-1321 is not reported in the NPM advisory while it is present on the advisory as hosted on GHSA

Expected behavior
CWE-1321 also reported in the dependency-check report

Additional context
Root cause is at an error in the NPMAuditParser. The cwe field is retrieved as an optional String, but the field in the API response is an array.

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions