dependency-check / dependency-check/DependencyCheck

Severity missing in csv report file (only CVSSv3_BaseSeverity is present)

Open
#3,617 3 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Is your feature request related to a problem? Please describe.**

Using csv reports to graph things and expose data to stakeholders (through PowerBI for instance), i've noticed that there are a lot of "N/A" values for "CVSSv3_BaseSeverity" field (around 56% in my case). Checking in json report file, i can see than there are 2 different fields related to severity:
- CVSSv3_BaseSeverity
- **Severity**

And it would be really nice to have also this second field in csv report file.

**Describe the solution you'd like**

Adding the "Severity" field in CSV report file, filled the same way than in json report. Checking the code, it seems that updating the csvReport.vsl template would fit the need :

additional field : "Severity"
value for this field (based on how value is filled in json report :
`#if($vuln.UnscoredSeverity)#if($vuln.unscoredSeverity.equals("0.0"))"Unknown"#else$enc.csv($vuln.unscoredSeverity)#end#elseif($vuln.cvssV3 && $vuln.cvssV3.baseSeverity)$enc.csv($vuln.cvssV3.baseSeverity)#elseif($vuln.cvssV2 && $vuln.cvssV2.severity)$severity($vuln.cvssV2.severity)#end`

**Additional context**
I tried to open PR for this but i didn't succeed building the project on my workstation (probably caused by a cache or something leading to error _DatabaseException: Database schema does not match this version of dep..._ and i didn't find any way to avoid this.

Thanks for your help on having this missing information in CSV report files, i would really appreciate it !
Regards,

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.