Specifying only Group Name and Version will not match VulnerableSoftware using the Internal Analyzer.

If you specify only the mandatory fields you'll never get a match using the Internal Analyzer.
```
String componentVersion;
String componentUpdate;
if (parsedCpe != null) {
componentVersion = parsedCpe.getVersion();
componentUpdate = parsedCpe.getUpdate();
} else if (component.getPurl() != null) {
componentVersion = component.getPurl().getVersion();
componentUpdate = null;
} else {
// Catch cases where the CPE couldn't be parsed and no PURL exists.
// Should be rare, but could lead to NPEs later.
LOGGER.debug("Neither CPE nor PURL of component " + component.getUuid() + " provide a version - skipping analysis");
return;
}
// In some cases, componentVersion may be null, such as when a Package URL does not have a version specified
if (componentVersion == null) {
return;
}`

```
That `else` short circuits the versionRangeAnalysis when there's no PURL and no CPE.

_Originally posted by @officerNordberg in https://github.com/DependencyTrack/dependency-track/discussions/2983#discussioncomment-6817170_