DependencyTrack / DependencyTrack/dependency-track

display CVEs from github the same way as the CVEs from NVD

Open
#4,047 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Many old vulnerabilities in github do not have a CVSS vector, nor a score. So no score gets displayed in the gui for an opened vulnerability from github. Also in the exported vex with CVEs with github as a source there is no score not vector.

### Proposed Behavior

Newer vulnerabilities have a score and a vector as can be seen here:
https://github.com/advisories/GHSA-w24x-87mr-4r23

Please support it the same way as the CVEs from NVD (so that in the vex file that is exported from dependency track) the score and cvss vector are there)

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.