From 921898c425e8b52275718a4b01dfab2ea8353ea3 Mon Sep 17 00:00:00 2001 From: Tushar Goel Date: Fri, 17 Jan 2025 17:32:38 +0530 Subject: [PATCH] Address review comments Signed-off-by: Tushar Goel --- .../templates/vulnerability_details.html | 103 ++++++++++++++++++ .../vulnerability_package_details.html | 22 +--- vulnerabilities/views.py | 23 +++- 3 files changed, 129 insertions(+), 19 deletions(-) diff --git a/vulnerabilities/templates/vulnerability_details.html b/vulnerabilities/templates/vulnerability_details.html index 4005c663c..e1ca6e4fd 100644 --- a/vulnerabilities/templates/vulnerability_details.html +++ b/vulnerabilities/templates/vulnerability_details.html @@ -47,6 +47,13 @@ +
  • + + + Severity details ({{ severity_vectors|length }}) + + +
    • {% if vulnerability.exploits %}
  • @@ -398,6 +405,102 @@ {% endfor %} + +
    + {% for severity_vector in severity_vectors %} + {% if severity_vector.version == '2.0' %} + Vector: {{ severity_vector.vectorString }} + + + + + + + + + + + + + + + + + + + +
    Exploitability (E)Access Vector (AV)Access Complexity (AC)Authentication (Au)Confidentiality Impact (C)Integrity Impact (I)Availability Impact (A)
    {{ severity_vector.exploitability|cvss_printer:"high,functional,unproven,proof_of_concept,not_defined" }}{{ severity_vector.accessVector|cvss_printer:"local,adjacent_network,network" }}{{ severity_vector.accessComplexity|cvss_printer:"high,medium,low" }}{{ severity_vector.authentication|cvss_printer:"multiple,single,none" }}{{ severity_vector.confidentialityImpact|cvss_printer:"none,partial,complete" }}{{ severity_vector.integrityImpact|cvss_printer:"none,partial,complete" }}{{ severity_vector.availabilityImpact|cvss_printer:"none,partial,complete" }}
    + {% elif severity_vector.version == '3.1' or severity_vector.version == '3.0'%} + Vector: {{ severity_vector.vectorString }} + + + + + + + + + + + + + + + + + + + + + +
    Attack Vector (AV)Attack Complexity (AC)Privileges Required (PR)User Interaction (UI)Scope (S)Confidentiality Impact (C)Integrity Impact (I)Availability Impact (A)
    {{ severity_vector.attackVector|cvss_printer:"network,adjacent_network,local,physical"}}{{ severity_vector.attackComplexity|cvss_printer:"low,high" }}{{ severity_vector.privilegesRequired|cvss_printer:"none,low,high" }}{{ severity_vector.userInteraction|cvss_printer:"none,required"}}{{ severity_vector.scope|cvss_printer:"unchanged,changed" }}{{ severity_vector.confidentialityImpact|cvss_printer:"high,low,none" }}{{ severity_vector.integrityImpact|cvss_printer:"high,low,none" }}{{ severity_vector.availabilityImpact|cvss_printer:"high,low,none" }}
    + {% elif severity_vector.version == '4' %} + Vector: {{ severity_vector.vectorString }} + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Attack Vector (AV)Attack Complexity (AC)Attack Requirements (AT)Privileges Required (PR)User Interaction (UI)Vulnerable System Impact Confidentiality (VC)Vulnerable System Impact Integrity (VI)Vulnerable System Impact Availability (VA)Subsequent System Impact Confidentiality (SC)Subsequent System Impact Integrity (SI)Subsequent System Impact Availability (SA)
    {{ severity_vector.attackVector|cvss_printer:"network,adjacent,local,physical"}}{{ severity_vector.attackComplexity|cvss_printer:"low,high" }}{{ severity_vector.attackRequirement|cvss_printer:"none,present" }}{{ severity_vector.privilegesRequired|cvss_printer:"none,low,high" }}{{ severity_vector.userInteraction|cvss_printer:"none,passive,active"}}{{ severity_vector.vulnerableSystemImpactConfidentiality|cvss_printer:"high,low,none" }}{{ severity_vector.vulnerableSystemImpactIntegrity|cvss_printer:"high,low,none" }}{{ severity_vector.vulnerableSystemImpactAvailability|cvss_printer:"high,low,none" }}{{ severity_vector.subsequentSystemImpactConfidentiality|cvss_printer:"high,low,none" }}{{ severity_vector.subsequentSystemImpactIntegrity|cvss_printer:"high,low,none" }}{{ severity_vector.subsequentSystemImpactAvailability|cvss_printer:"high,low,none" }}
    + {% elif severity_vector.version == 'ssvc' %} +
    + Vector: {{ severity_vector.vectorString }} +
    + {% endif %} + {% empty %} + + + There are no known vectors. + + + {% endfor %} +
    diff --git a/vulnerabilities/templates/vulnerability_package_details.html b/vulnerabilities/templates/vulnerability_package_details.html index 1eb3cc4ce..21fb52192 100644 --- a/vulnerabilities/templates/vulnerability_package_details.html +++ b/vulnerabilities/templates/vulnerability_package_details.html @@ -6,7 +6,7 @@ {% load url_filters %} {% block title %} -VulnerableCode Vulnerability Details - {{ vulnerability.vulnerability_id }} +VulnerableCode Vulnerability Package Details - {{ vulnerability.vulnerability_id }} {% endblock %} {% block content %} @@ -16,27 +16,14 @@
    - Vulnerability details: + Vulnerable and Fixing Package details for Vulnerability: {{ vulnerability.vulnerability_id }}
    - - -
    -
    - +
    +
    @@ -76,7 +63,6 @@
    Affected
    -
    {% endif %} diff --git a/vulnerabilities/views.py b/vulnerabilities/views.py index 8d29d140f..5cea2e689 100644 --- a/vulnerabilities/views.py +++ b/vulnerabilities/views.py @@ -182,12 +182,33 @@ def get_context_data(self, **kwargs): if weakness_object.weakness ] + severity_vectors = [] + severity_values = set() + for s in self.object.severities.all(): + if s.scoring_system == EPSS.identifier: + continue + + if s.scoring_elements and s.scoring_system in SCORING_SYSTEMS: + try: + vector_values = SCORING_SYSTEMS[s.scoring_system].get(s.scoring_elements) + severity_vectors.append(vector_values) + except ( + CVSS2MalformedError, + CVSS3MalformedError, + CVSS4MalformedError, + NotImplementedError, + ): + logging.error(f"CVSSMalformedError for {s.scoring_elements}") + + if s.value: + severity_values.add(s.value) + context.update( { "vulnerability": vulnerability, "vulnerability_search_form": VulnerabilitySearchForm(self.request.GET), "severities": list(vulnerability.severities.all()), - "severity_score_range": "", + "severity_vectors": severity_vectors, "references": list(vulnerability.references.all()), "aliases": list(vulnerability.aliases.all()), "weaknesses": weaknesses_present_in_db,