DependencyTrack / DependencyTrack/dependency-track
NistMirrorTask: Impact not inserted
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior:
The NistMirroringTask is downlaoding the nvdcve-1.1-modified.json.gz instead of the bigger yearly files.
The file contains a complete dataset to each changed CVE (Example with CVE-2022-0778 attached, which contains also the impact)
Unfortunatly dependencytrack did not read in the impact and shows the Entry as unassigned:

### Steps to Reproduce:
Keep Dependencytrack running for a view days
### Expected Behavior:
The CVE has an uodated Impact
### Environment:
- Dependency-Track Version: 4.4.1
- Distribution: [ Docker ]
- BOM Format & Version: 1.2
- Database Server: [ MSSQL]
- Browser: Chrome
### Additional Details:
Impact entry of the above CVE:
```
"impact" : {
"baseMetricV3" : {
"cvssV3" : {
"version" : "3.1",
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector" : "NETWORK",
"attackComplexity" : "LOW",
"privilegesRequired" : "NONE",
"userInteraction" : "NONE",
"scope" : "UNCHANGED",
"confidentialityImpact" : "NONE",
"integrityImpact" : "NONE",
"availabilityImpact" : "HIGH",
"baseScore" : 7.5,
"baseSeverity" : "HIGH"
},
"exploitabilityScore" : 3.9,
"impactScore" : 3.6
},
"baseMetricV2" : { ....
```
[nvdcve-1.1-modified.json.gz](https://github.com/DependencyTrack/dependency-track/files/8322751/nvdcve-1.1-modified.json.gz)
Contributor guide
Assessment
This issue has not been assessed yet.