dependency-check / dependency-check/DependencyCheck
Severity missing in csv report file (only CVSSv3_BaseSeverity is present)
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Is your feature request related to a problem? Please describe.**
Using csv reports to graph things and expose data to stakeholders (through PowerBI for instance), i've noticed that there are a lot of "N/A" values for "CVSSv3_BaseSeverity" field (around 56% in my case). Checking in json report file, i can see than there are 2 different fields related to severity:
- CVSSv3_BaseSeverity
- **Severity**
And it would be really nice to have also this second field in csv report file.
**Describe the solution you'd like**
Adding the "Severity" field in CSV report file, filled the same way than in json report. Checking the code, it seems that updating the csvReport.vsl template would fit the need :
additional field : "Severity"
value for this field (based on how value is filled in json report :
`#if($vuln.UnscoredSeverity)#if($vuln.unscoredSeverity.equals("0.0"))"Unknown"#else$enc.csv($vuln.unscoredSeverity)#end#elseif($vuln.cvssV3 && $vuln.cvssV3.baseSeverity)$enc.csv($vuln.cvssV3.baseSeverity)#elseif($vuln.cvssV2 && $vuln.cvssV2.severity)$severity($vuln.cvssV2.severity)#end`
**Additional context**
I tried to open PR for this but i didn't succeed building the project on my workstation (probably caused by a cache or something leading to error _DatabaseException: Database schema does not match this version of dep..._ and i didn't find any way to avoid this.
Thanks for your help on having this missing information in CSV report files, i would really appreciate it !
Regards,
Contributor guide
Assessment
This issue has not been assessed yet.