dependency-check / dependency-check/DependencyCheck

Add weighed vulnerability score

Open
#223 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

A weighed vulnerability score should be added to the core. It will be used in the Sonar plugin and potentially the Jenkins plugin.

Ideally, the risk of the vulnerabilities discovered would take into consideration the reliance (based on imports or usage) of the vulnerable dependency and the size of the codebase. However, since Dependency-Check cannot guarantee any visibility into this information, we need to use the information currently available in the XML report.

Potential datapoints include:
- HIGH (total high severity vulns)
- MEDIUM (total medium severity vulns)
- LOW (total low severity vulns)
- TOTAL_VULNS (total number of all vulnerabilities)
- TOTAL_DEPS (total number of dependencies scanned)
- VULN_DEPS (number of vulnerable dependencies)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.