Viewing Vulnerability Details

Perform the following steps to view vulnerability details.

1. In the Vulnerability Catalog page, select an application.

2. Select a desired vulnerability.

3. Click Show Details to view the detailed information.

   

The following information is displayed.

• The severity level assigned to the vulnerability by FortiDevSec

• The current status of the vulnerability. You can change the status by selecting a different option from the dropdown menu.

  

• The Overview section contains the following information.

  • The name of the application in which the vulnerability was found.

  • The name of the software package or component where the vulnerability was found.

  • The associated file and the line number that the vulnerability is found in.
  • The Issue description and the associated CWE and CVE (if any). Click on the CWE/CVE link to view details.
  • The Remediation provides information (if available) on how to fix/avoid the vulnerability.
  • The associated OWASP Top10 or SANS Top 25 category.
  • The Outbreak Alert lists the alerts found in the application. Click outbreak alert link to navigate to the FortiGuard Outbreak Alert page for in-depth analysis.
  • The Supply Chain provides information on the supply chain threat detected.

• The Similar Occurrences section contains the number of times this vulnerability has been detected in other applications or environments. Click on each instance to view its details. Expand each instance to see additional information. You can also use the search field to find occurrences within other files.

  

• The Details section contains the following information.
  • The CI/CD and Build details.
  • The history of the vulnerability is also displayed that includes the time of its first and last appearance.

  

The vulnerabilities details page for the SECRET scanner contains the following additional information in Overview tab.

• The Secret Type displays the type of secret detected.

• The Secret Status displays the current status of the secret detected.

  • JWT - Expired or Valid

  • AWS - Exploitable or Not Exploitable

• The Detected In provides information on where the secret was detected.
  Note: Secrets are first detected in git commits and then searched for in files.

• The Code field includes the following information.

  • Hash - Git commit hash.

  • By - Details of the user who has committed the change.

  • The last line in code field contains the commit message added by the user. If the GIT commit message is more than 200 characters it is truncated.

• The Associated Issues displays fingerprint for other components of the exploitable AWS credential within the same file.