Skip to content

Commit 921898c

Browse files
TG1999TG1999
committed
Address review comments
Signed-off-by: Tushar Goel <[email protected]>
1 parent ca61981 commit 921898c

File tree

3 files changed

+129
-19
lines changed

3 files changed

+129
-19
lines changed

‎vulnerabilities/templates/vulnerability_details.html

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,13 @@
4747
</span>
4848
</a>
4949
</li>
50+
<li data-tab="severities-vectors">
51+
<a>
52+
<span>
53+
Severity details ({{ severity_vectors|length }})
54+
</span>
55+
</a>
56+
</li>
5057

5158
{% if vulnerability.exploits %}
5259
<li data-tab="exploits">
@@ -398,6 +405,102 @@
398405
</tr>
399406
{% endfor %}
400407
</div>
408+
409+
<div class="tab-div content" data-content="severities-vectors">
410+
{% for severity_vector in severity_vectors %}
411+
{% if severity_vector.version == '2.0' %}
412+
Vector: {{ severity_vector.vectorString }}
413+
<table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth gray-header-border">
414+
<tr>
415+
<th>Exploitability (E)</th>
416+
<th>Access Vector (AV)</th>
417+
<th>Access Complexity (AC)</th>
418+
<th>Authentication (Au)</th>
419+
<th>Confidentiality Impact (C)</th>
420+
<th>Integrity Impact (I)</th>
421+
<th>Availability Impact (A)</th>
422+
</tr>
423+
<tr>
424+
<td>{{ severity_vector.exploitability|cvss_printer:"high,functional,unproven,proof_of_concept,not_defined" }}</td>
425+
<td>{{ severity_vector.accessVector|cvss_printer:"local,adjacent_network,network" }}</td>
426+
<td>{{ severity_vector.accessComplexity|cvss_printer:"high,medium,low" }}</td>
427+
<td>{{ severity_vector.authentication|cvss_printer:"multiple,single,none" }}</td>
428+
<td>{{ severity_vector.confidentialityImpact|cvss_printer:"none,partial,complete" }}</td>
429+
<td>{{ severity_vector.integrityImpact|cvss_printer:"none,partial,complete" }}</td>
430+
<td>{{ severity_vector.availabilityImpact|cvss_printer:"none,partial,complete" }}</td>
431+
</tr>
432+
</table>
433+
{% elif severity_vector.version == '3.1' or severity_vector.version == '3.0'%}
434+
Vector: {{ severity_vector.vectorString }}
435+
<table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth gray-header-border">
436+
<tr>
437+
<th>Attack Vector (AV)</th>
438+
<th>Attack Complexity (AC)</th>
439+
<th>Privileges Required (PR)</th>
440+
<th>User Interaction (UI)</th>
441+
<th>Scope (S)</th>
442+
<th>Confidentiality Impact (C)</th>
443+
<th>Integrity Impact (I)</th>
444+
<th>Availability Impact (A)</th>
445+
</tr>
446+
<tr>
447+
<td>{{ severity_vector.attackVector|cvss_printer:"network,adjacent_network,local,physical"}}</td>
448+
<td>{{ severity_vector.attackComplexity|cvss_printer:"low,high" }}</td>
449+
<td>{{ severity_vector.privilegesRequired|cvss_printer:"none,low,high" }}</td>
450+
<td>{{ severity_vector.userInteraction|cvss_printer:"none,required"}}</td>
451+
<td>{{ severity_vector.scope|cvss_printer:"unchanged,changed" }}</td>
452+
<td>{{ severity_vector.confidentialityImpact|cvss_printer:"high,low,none" }}</td>
453+
<td>{{ severity_vector.integrityImpact|cvss_printer:"high,low,none" }}</td>
454+
<td>{{ severity_vector.availabilityImpact|cvss_printer:"high,low,none" }}</td>
455+
</tr>
456+
</table>
457+
{% elif severity_vector.version == '4' %}
458+
Vector: {{ severity_vector.vectorString }}
459+
<table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth gray-header-border">
460+
<tr>
461+
<th>Attack Vector (AV)</th>
462+
<th>Attack Complexity (AC)</th>
463+
<th>Attack Requirements (AT)</th>
464+
<th>Privileges Required (PR)</th>
465+
<th>User Interaction (UI)</th>
466+
467+
<th>Vulnerable System Impact Confidentiality (VC)</th>
468+
<th>Vulnerable System Impact Integrity (VI)</th>
469+
<th>Vulnerable System Impact Availability (VA)</th>
470+
471+
<th>Subsequent System Impact Confidentiality (SC)</th>
472+
<th>Subsequent System Impact Integrity (SI)</th>
473+
<th>Subsequent System Impact Availability (SA)</th>
474+
</tr>
475+
<tr>
476+
<td>{{ severity_vector.attackVector|cvss_printer:"network,adjacent,local,physical"}}</td>
477+
<td>{{ severity_vector.attackComplexity|cvss_printer:"low,high" }}</td>
478+
<td>{{ severity_vector.attackRequirement|cvss_printer:"none,present" }}</td>
479+
<td>{{ severity_vector.privilegesRequired|cvss_printer:"none,low,high" }}</td>
480+
<td>{{ severity_vector.userInteraction|cvss_printer:"none,passive,active"}}</td>
481+
482+
<td>{{ severity_vector.vulnerableSystemImpactConfidentiality|cvss_printer:"high,low,none" }}</td>
483+
<td>{{ severity_vector.vulnerableSystemImpactIntegrity|cvss_printer:"high,low,none" }}</td>
484+
<td>{{ severity_vector.vulnerableSystemImpactAvailability|cvss_printer:"high,low,none" }}</td>
485+
486+
<td>{{ severity_vector.subsequentSystemImpactConfidentiality|cvss_printer:"high,low,none" }}</td>
487+
<td>{{ severity_vector.subsequentSystemImpactIntegrity|cvss_printer:"high,low,none" }}</td>
488+
<td>{{ severity_vector.subsequentSystemImpactAvailability|cvss_printer:"high,low,none" }}</td>
489+
</tr>
490+
</table>
491+
{% elif severity_vector.version == 'ssvc' %}
492+
<hr/>
493+
Vector: {{ severity_vector.vectorString }}
494+
<hr/>
495+
{% endif %}
496+
{% empty %}
497+
<tr>
498+
<td>
499+
There are no known vectors.
500+
</td>
501+
</tr>
502+
{% endfor %}
503+
</div>
401504

402505

403506
<div class="tab-div content" data-content="epss">

‎vulnerabilities/templates/vulnerability_package_details.html

Lines changed: 4 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
{% load url_filters %}
77

88
{% block title %}
9-
VulnerableCode Vulnerability Details - {{ vulnerability.vulnerability_id }}
9+
VulnerableCode Vulnerability Package Details - {{ vulnerability.vulnerability_id }}
1010
{% endblock %}
1111

1212
{% block content %}
@@ -16,27 +16,14 @@
1616
<div class="details-container">
1717
<article class="panel is-info panel-header-only">
1818
<div class="panel-heading py-2 is-size-6">
19-
Vulnerability details:
19+
Vulnerable and Fixing Package details for Vulnerability:
2020
<span class="tag is-white custom">
2121
{{ vulnerability.vulnerability_id }}
2222
</span>
2323
</div>
2424
</article>
25-
26-
<div class="tabs is-boxed" id="tabs">
27-
<ul>
28-
<li data-tab="affected-fixed-by">
29-
<a>
30-
<span>
31-
Affected/Fixed by packages ({{ affected_packages|length }}/{{ fixed_by_packages|length }})
32-
</span>
33-
</a>
34-
</li>
35-
</ul>
36-
</div>
37-
<div id="tab-content">
38-
<div class="tab-div is-active" data-content="affected-fixed-by">
39-
<table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth">
25+
<div id="tab-content">
26+
<table class="table vcio-table width-100-pct mt-2">
4027
<thead>
4128
<tr>
4229
<th style="width: 50%;">Affected</th>
@@ -76,7 +63,6 @@
7663
</tbody>
7764
</table>
7865
</div>
79-
</div>
8066
</div>
8167
</section>
8268
{% endif %}

‎vulnerabilities/views.py

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -182,12 +182,33 @@ def get_context_data(self, **kwargs):
182182
if weakness_object.weakness
183183
]
184184

185+
severity_vectors = []
186+
severity_values = set()
187+
for s in self.object.severities.all():
188+
if s.scoring_system == EPSS.identifier:
189+
continue
190+
191+
if s.scoring_elements and s.scoring_system in SCORING_SYSTEMS:
192+
try:
193+
vector_values = SCORING_SYSTEMS[s.scoring_system].get(s.scoring_elements)
194+
severity_vectors.append(vector_values)
195+
except (
196+
CVSS2MalformedError,
197+
CVSS3MalformedError,
198+
CVSS4MalformedError,
199+
NotImplementedError,
200+
):
201+
logging.error(f"CVSSMalformedError for {s.scoring_elements}")
202+
203+
if s.value:
204+
severity_values.add(s.value)
205+
185206
context.update(
186207
{
187208
"vulnerability": vulnerability,
188209
"vulnerability_search_form": VulnerabilitySearchForm(self.request.GET),
189210
"severities": list(vulnerability.severities.all()),
190-
"severity_score_range": "",
211+
"severity_vectors": severity_vectors,
191212
"references": list(vulnerability.references.all()),
192213
"aliases": list(vulnerability.aliases.all()),
193214
"weaknesses": weaknesses_present_in_db,

0 commit comments

Comments
 (0)