v1

latestOpenAPI 3.0.12026-08-06151265417.9 KB

Findings - Project

Get project security findings (Dependencies - SCA)

Returns all security findings for a given project

get/api/v3.0/projects/{projectUuid}/dependencies/findings/security

Path parameters

projectUuidstring required

UUID of the project

Query parameters

limitstring

Specifies the maximum number of items to be returned in the response.

cursorstring

Parameter indicates the starting point for retrieving results, the first call doesn't include a cursor parameter in the request, the API response includes the first set of results along with a cursor pointing to the last item retrieved.

UUID or Name of a Zero-Day Event

Response

additionalDataobject

totalItems: The total count of data points returned in an API response.

supportTokenstring

Example response

{
  "additionalData": {
    "totalItems": "422",
    "next": "http://someUrl?cursor=3",
    "cursor": 3
  },
  "supportToken": "1171c60d",
  "response": [
    {
      "uuid": "123e4567-e89b-12d3-a456-426655440000",
      "name": "CVE-2021-42392",
      "type": "SECURITY_VULNERABILITY",
      "findingInfo": {
        "comment": {
          "comment": "a comment",
          "userEmail": "jon.smith@mail.com",
          "username": "jon"
        }
      },
      "project": {
        "uuid": "123e4567-e89b-12d3-a456-426655440000",
        "name": "My Project",
        "path": "My Application",
        "applicationName": "My Application",
        "applicationUuid": "123e4567-e89b-12d3-a456-426655440000"
      },
      "application": {
        "uuid": "123e4567-e89b-12d3-a456-426655440000",
        "name": "Application A"
      },
      "component": {
        "uuid": "123e4567-e89b-12d3-a456-426655440000",
        "name": "dbus-1.10.24-13.el7_6.x86_64.rpm",
        "description": "Component description",
        "componentType": "Library",
        "libraryType": "REDHAT_PACKAGE_MODULE",
        "language": "REDHAT_PACKAGE_MODULE",
        "references": {
          "url": "https://www.gnupg.org/related_software/pinentry/98",
          "homePage": "https://www.gnupg.org/related_software/pinentry/89",
          "downloadLink": "https://www.gnupg.org/related_software/pinentry/09",
          "issueUrl": "https://www.gnupg.org/related_software/pinentry/87",
          "pomUrl": "https://www.gnupg.org/related_software/pinentry/76",
          "scmUrl": "https://www.gnupg.org/related_software/pinentry/65",
          "genericPackageIndex": "5",
          "tags": "Important",
          "copyright": "Copyright 2002-2015 g10 Code GmbH"
        },
        "groupId": "org.springframework.boot",
        "artifactId": "spring-boot",
        "version": "3.0.5",
        "path": "pom.xml",
        "dependencyType": "Direct / Transitive",
        "libraryLocations": [
          {
            "localPath": "C:\\\\Users\\\\user\\\\.m2\\\\repository\\\\commons-io-1.4.jar",
            "dependencyFile": "C:\\\\GitHubRepos\\\\Pipline\\\\EUA\\\\plugins-automation\\\\fsa\\\\tests\\\\EUA\\\\Java\\\\bigProjectsMaven\\\\WST_417\\\\Data\\\\ksa\\\\ksa-web-core\\\\pom.xml"
          }
        ]
      },
      "vulnerability": {
        "name": "CVE-2021-42392",
        "type": "WS",
        "description": "Security vulnerability found in plexus-utils before 3.0.24. XML injection found in XmlWriterUtil.java",
        "score": 5,
        "severity": "MEDIUM",
        "vulnerabilityScoring": [
          {
            "score": 5,
            "severity": "MEDIUM",
            "type": "CVSS_2",
            "scoreMetadataVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "source": "NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
          }
        ],
        "references": [
          {
            "value": "https://github.com/codehaus-plexus/plexus-utils/commit/f933e5e78dc2637e485447ed821fe14904f110de",
            "source": "CERT",
            "url": "https://github.com/codehaus-plexus/plexus-utils/commit/f933e5e78dc2637e485447ed821fe14904f110de"
          }
        ],
        "threatAssessment": {
          "exploitCodeMaturity": "HIGH",
          "epssPercentage": 0.8
        }
      },
      "topFix": {
        "id": 49422,
        "vulnerability": "CVE-2021-42392",
        "type": "UPGRADE_VERSION",
        "origin": "WHITESOURCE_EXPERT",
        "url": "https://github.com/codehaus-plexus/plexus-utils/commit/f933e5e78dc2637e485447ed821fe14904f110de",
        "fixResolution": "3.0.24",
        "message": "Upgrade to version"
      },
      "findingIntegration": {
        "status": "SUCCESS",
        "issues": [
          {
            "issueStatus": "Open",
            "url": "www.jira.com/projectA-22",
            "issueTrackerType": "Jira-cloud",
            "issueIdentifier": "projectA-22"
          }
        ]
      },
      "threatAssessment": {
        "exploitCodeMaturity": "HIGH",
        "epssPercentage": 0.8
      },
      "exploitable": true,
      "malicious": true,
      "violations": 22,
      "dependencyContexts": [
        {
          "dependencyType": "DIRECT",
          "isDirect": true,
          "directRoots": [
            {
              "rootLibraryName": "com.google.guava:guava",
              "rootLibraryVersion": "30.1-jre"
            }
          ]
        }
      ]
    }
  ]
}