Vulnerabilities

Secure Application continuously scans applications to detect security weaknesses and potential threats and displays scan results on the Runtime vulnerabilities tab to help you to prioritize remediation efforts.

Dashboards

Interactive dashboards at the top of the tab provide quick drill-down support to isolate security findings by service and infrastructure context. Select a value in any dashboard to filter its chart by that value.

• Open vulnerabilities by severity: A bar chart providing a breakdown of the open vulnerabilities within the time frame you selected, categorizing them by their severity level and highlighting the distribution across critical, high, medium, and low categories.

• Severity trend: A line chart tracking the fluctuations in the number of vulnerabilities across different severity levels over the past week, offering a visual representation of security trends over time.

• Days since first detected: This stacked bar chart shows vulnerabilities actively detected within the past week, grouped by how long they have been present since first detection, from those first seen within the last day to those persisting for over 14 days, broken down by severity.

Vulnerability list

The vulnerability list is sorted by the Status column by default. You can filter it by Library type.

List columns:

• CVE title: The category of security weakness detected, based on industry-standard CWE classifications. Examples include input validation errors, memory safety issues, and API misuse.

• CVE ID: A unique alphanumeric identifier assigned to a single, publicly disclosed cybersecurity vulnerability. Maintained by the Common Vulnerabilities and Exposures (CVE) program, this ID allows organizations to unambiguously identify and track a specific vulnerability across different security tools and databases. The format is typically "CVE-YYYY-NNNNN," where YYYY is the year of disclosure.

• CWE-ID: A unique identifier within the Common Weakness Enumeration (CWE) system. This identifies a specific category of vulnerability rather than a specific instance in a particular product. While a CVE identifies a specific flaw in a specific version of a library, a CWE describes the underlying category of the flaw.

• CVSS Score: Common Vulnerability Scoring System (CVSS) score v3. The CVSS is a numeric value from 0.0 to 10.0 that represents the severity of a vulnerability. This open industry standard helps organizations assess and prioritize remediation efforts based on principal characteristics like exploitability and potential impact. A higher score indicates a more severe vulnerability.

• EPSS: The Exploit Prediction Scoring System (EPSS) provides both a probability of vulnerability exploitation in the wild and a percentile ranking relative to all known EPSS scores. EPSS is updated daily.

• Status: Current state of the vulnerability:

  • Detected (vulnerability is found)

  • Confirmed (vulnerability is valid or reviewed)

  • Fixed (vulnerability is fixed)

  • Ignored (not a vulnerability)

• CVEs Reached: A list of CVEs which are associated with this attack.

• Environment: The value you specified in your Secure Application agent otel.resource.attributes parameter or in the OTEL_RESOURCE_ATTRIBUTE environment variable.

• Library: Name of the library.

• Last detected

• Recommended action: Any remediation that is available for the library.

Vulnerability details

Select a vulnerability in the list to view its details, a comprehensive breakdown of a specific security vulnerability, enabling you to assess its severity and determine the necessary steps for remediation.

Vulnerability details are organized into the following sections:

• CVSS Score: Displays the severity rating and the CVSS3 Vector String to help you understand the vulnerability's technical severity.
• Threat Intelligence: Provides the EPSS score.
• Details: Contains essential metadata such as Title, ID, CWE, Publish date, Last detected, Package, Affected version, Fix version, and Library.
• Recommended actions: Offers clear guidance on how to mitigate the risk, typically by recommending a specific version upgrade for the affected library.
• Description: Provides a detailed explanation of the vulnerability.
• Workarounds: Lists temporary measures to reduce immediate risk, such as specific configuration changes.
• Remediation: Outlines the necessary steps to permanently resolve the vulnerability, such as upgrading to a specific version.
• References: Provides a list of external links for further research such as GitHub commits, security advisories, and industry databases.
• A list of services affected by this vulnerability. Includes a column of the observed hosts (hosts that were observed to be running the service). Select a link in the host column to see host IDs and time stamps of when they were last seen. This information is updated every 24 hours.

Update the status of a vulnerability

You can change the status of any vulnerability to Ignored or Confirmed as long as its status isn't Fixed since a Fixed status indicates that you've already remediated it.

1. Select single or multiple vulnerabilities of the same status type.

2. Change their status to Ignored or Confirmed.

3. On the confirmation pop-up select Yes.

   The Status column of those vulnerabilities now displays the value you specified.