Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature: Klar check whitelisted CVEs and notify on CVE changed Vector (Score) #190

Open
HarvyNBB opened this issue Apr 27, 2023 · 0 comments

Comments

@HarvyNBB
Copy link

HarvyNBB commented Apr 27, 2023

### Brief:
Some CVEs when created they have a unique defined vector and base score, However whenever there are any changes noticed for these CVEs, they could end with a changed vector and hence base score.

For instance https://nvd.nist.gov/vuln/detail/CVE-2021-39212
it was published on 09/13/2021 by NVD with

  • Base Score: 3.6 LOW

  • Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Then changed on 08/05/2022 by GitHub, Inc. to be

  • Base Score: 4.4 MEDIUM

  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

In case this CVE is whitelisted based on the initial score which is 3.6 Low, there is no way to get notified with this change.

### Feature request:
Klar checks the whitelisted CVE and notifies whenever there is a vector (score) change detected for this CVE since being whitelisted

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant