Web App Scanning Findings Properties

The state as determined by the Tenable Web App Scanning state service. Possible values include:

• OPEN — The compliance finding is currently present on an asset.

• REOPENED — The compliance finding was previously marked as fixed on an asset but has been detected again by a new scan.

• FIXED — The compliance finding was present on an asset but is no longer detected.

• ACTIVE — The compliance finding is currently active on an asset.

Note that the API uses different terms for states than the user interface. The new and active states in the user interface map to the OPEN state in the API. The resurfaced state in the user interface maps to the REOPENED state in the API. The fixed state is the same.

The code for the severity assigned when a user recast the risk associated with the finding. Possible values include:

• 0 — The vulnerability has a CVSS score of 0, which corresponds to the info severity level.

• 1 — The vulnerability has a CVSS score between 0.1 and 3.9, which corresponds to the low severity level.

• 2 — The vulnerability has a CVSS score between 4.0 and 6.9, which corresponds to the medium severity level.

• 3 — The vulnerability has a CVSS score between 7.0 and 9.9, which corresponds to the high severity level.

• 4 — The vulnerability has a CVSS score of 10.0, which corresponds to the critical severity level.

The type of modification a user made to the finding's severity. Possible values include:

• NONE — No modification has been made.

• RECASTED — A user in the Tenable Web App Scanning user interface has recast the risk associated with the finding.

• ACCEPTED — A user in the Tenable Web App Scanning user interface has accepted the risk associated with the finding.

For more information about recast and accept rules, see Recast/Accept Rules in the Tenable Vulnerability Management User Guide.

The risk factor of the finding associated with the plugin. The risk factor is determined based on the calculation of the CVSS score. The possible values are:

• LOW — The vulnerability has a CVSS score between 0.1 and 3.9.

• MEDIUM — The vulnerability has a CVSS score between 4.0 and 6.9.

• HIGH — The vulnerability has a CVSS score between 7.0 and 9.9.

• CRITICAL — The vulnerability has a CVSS score of 10.0.

Filter on the VPR v2 score percentile ranking of the CVE, indicating its position relative to other vulnerabilities.

Filter on the VPR v2 severity categorization of the CVE. Options are Critical, High, Medium, Low, Info.

Filter on the probability of exploitation produced by the VPR v2 threat model for the CVE.

Filter on current availability and maturity of exploit code. Options are High, Functional, POC, and Unproven.

Filter on whether the CVE is listed on the CISA Known Exploited Vulnerabilities list. Options are Yes, No.

Filter on categories of news sources that have referenced the CVE within the last 30 days. Select from one or more of Academic and Research Institutions, Blogs and Individual Researchers, Code Repositories, Cybersecurity News Media, Cybersecurity Vendors, Forums and Community Platforms, Government and Regulatory, Mainstream News and Media, Security Research, Technology Companies, Tools and Resources, Other.

Filter on the volume of observed malware exploiting the CVE within the last 30 days. Options are Very Low, Low, Medium, High, Very High.

Filter on the recency of observed malware exploiting the CVE. Options are No Recorded Events, 60 to 180 days, 30 to 60 days, 14 to 30 days, 7 to 14 days, 0 to 7 days.

Allows filtering on specific industries where attacks leveraging the CVE have been observed. Sample options include Banking, Technology, Government.

Allows filtering on specific geographic regions where attacks leveraging the CVE have been observed.

A range representing the number of days since the National Vulnerability Database (NVD) published the vulnerability. The valid ranges are:

• 0-7 days

• 7-30 days

• 30-60 days

• 60-180 days

• 180-365 days

• 365-730 days

• More than 730 days (+731)

The relative maturity of a possible exploit for the vulnerability based on the existence, sophistication, and prevalence of exploit intelligence from internal and external sources (for example, Reversinglabs, Exploit-db, Metasploit).

The possible values (HIGH, FUNCTIONAL, POC, or UNPROVEN) parallel the CVSS Exploit Code Maturity categories.

The relative intensity based on the number and frequency of recently observed threat events related to this vulnerability. The possible values are:

• VERY LOW

• LOW

• MEDIUM

• HIGH

• VERY HIGH

A range representing the number of days since a threat event occurred for the vulnerability. The possible ranges are:

• 0-7 days

• 7-30 days

• 30-120 days

• 120-365 days

• More than 365 days (+365)

The relative number of unique products affected by the vulnerability. The possible values are:

• LOW

• MEDIUM

• HIGH

• VERY HIGH

The CVSSv2 Exploitability (E) temporal metric for the vulnerability the plugin covers. The possible values are:

• U — Unproven

• POC — Proof-of-Concept

• F — Functional

• H — High

• ND — Not Defined

The CVSSv2 Remediation Level (RL) temporal metric for the vulnerability the plugin covers. The valid values are:

• O — Official Fix

• T — Temporary Fix

• W — Workaround

• U — Unavailable

• X — Not Defined

The CVSSv2 Report Confidence (RC) temporal metric for the vulnerability the plugin covers. The possible values are:

• UC — Unconfirmed

• UR — Uncorroborated

• C — Confirmed

• ND — Not Defined

The CVSSv2 Access Complexity (AC) metric for the vulnerability the plugin covers. The possible values are:

• H — High

• M — Medium

• L — Low

The CVSSv2 Access Vector (AV) metric for the vulnerability the plugin covers. The possible values are:

• L — Local

• A — Adjacent Network

• N — Network

The CVSSv2 Authentication (Au) metric for the vulnerability the plugin covers. The possible values are:

• N — None Required

• S — Single

• M — Multiple

The CVSSv2 availability impact metric for the vulnerability the plugin covers. The possible values are:

• N — None

• P — Partial

• C — Complete

The CVSSv2 confidentiality impact metric for the vulnerability the plugin covers.The possible values are:

• N — None

• P — Partial

• C — Complete

The CVSSv2 integrity impact metric for the vulnerability the plugin covers. The possible values are:

• N — None

• P — Partial

• C — Complete

The CVSSv3 Exploit Maturity Code (E) for the vulnerability the plugin covers. The possible values are:

• Unproven — Corresponds to the Unproven (U) value for the E metric.

• Proof-of-concept — Corresponds to the Proof-of-Concept (POC) value for the E metric.

• Functional — Corresponds to the Functional (F) value for the E metric.

• High — Corresponds to the High (H) value for the E metric.

• Not-defined — Corresponds to the Not Defined (ND) value for the E metric.

The CVSSv3 Remediation Level (RL) temporal metric for the vulnerability the plugin covers. The valid values are:

• O — Official Fix

• T — Temporary Fix

• W — Workaround

• U — Unavailable

• X — Not Defined

The CVSSv3 Report Confidence (RC) temporal metric for the vulnerability the plugin covers. The possible values are:

• U — Unknown

• R — Reasonable

• C — Confirmed

• X — Not Defined

The CVSSv3 Access Complexity (AC) metric for the vulnerability the plugin covers. The possible values are:

• H — High

• M — Medium

• L — Low

The CVSSv3 Attack Vector (AV) metric for the vulnerability the plugin covers. The possible values are:

• Network — Corresponds to the Network (N) value for the AV metric.

• Adjacent Network — Corresponds to the Adjacent Network (A) value for the AV metric.

• Local — Corresponds to the Local (L) value for the AV metric.

The CVSSv3 Authentication (Au) metric for the vulnerability the plugin covers. The possible values are:

• None required — Corresponds to the None (N) value for the Au metric.

• Requires-single-instance — Corresponds to the Single (S) value for the Au metric.

• Requires-multiple-instances — Corresponds to the Multiple (M) value for the Au metric.

The CVSSv3 availability impact metric for the vulnerability the plugin covers. The possible values are:

• H — High

• L — Low

• N — None

The CVSSv3 confidentiality impact metric for the vulnerability the plugin covers.The possible values are:

• H — High

• L — Low

• N — None

The CVSSv3 integrity impact metric for the vulnerability the plugin covers. The possible values are:

• H — High

• L — Low

• N — None

The CVSS v4.0 threat score (CVSS-T), which adjusts the base score by incorporating real-world threat intelligence, such as the presence of active exploitation, exploit code availability, or observed malware activity. This score reflects the current threat landscape for the vulnerability. For more details, see the CVSS v4.0 Specification.

The context where vulnerability exploitation is possible, such as Network or Local.

The permission level attackers require to exploit the vulnerability. Options are High, Low, or None. For example, None means attackers need no permissions in your environment and can exploit the vulnerability while unauthorized.

The level of user involvement required for an attacker to exploit the vulnerability.

The impact on the availability of the vulnerable system when successfully exploited.

The impact on the confidentiality of the vulnerable system when successfully exploited.

The impact on the integrity of the vulnerable system when successfully exploited.

The impact on the availability of systems that can be impacted after the vulnerable system is exploited.

The impact on the confidentiality of systems that can be impacted after the vulnerable system is exploited.

The impact on the integrity of systems that can be impacted after the vulnerable system is exploited.