dependency-check / dependency-check/DependencyCheck
Add weighed vulnerability score
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
A weighed vulnerability score should be added to the core. It will be used in the Sonar plugin and potentially the Jenkins plugin.
Ideally, the risk of the vulnerabilities discovered would take into consideration the reliance (based on imports or usage) of the vulnerable dependency and the size of the codebase. However, since Dependency-Check cannot guarantee any visibility into this information, we need to use the information currently available in the XML report.
Potential datapoints include:
- HIGH (total high severity vulns)
- MEDIUM (total medium severity vulns)
- LOW (total low severity vulns)
- TOTAL_VULNS (total number of all vulnerabilities)
- TOTAL_DEPS (total number of dependencies scanned)
- VULN_DEPS (number of vulnerable dependencies)
Contributor guide
Assessment
This issue has not been assessed yet.