View Findings Details

Required Tenable Web App Scanning User Role: Basic, Scan Operator, Standard, Scan Manager, or Administrator

On the Findings page, you can click a Tenable Web App Scanning vulnerability finding to view basic details about the finding in the preview panel.

To view details for a specific finding:

In the upper-left corner, click the button.

The left navigation plane appears.
In the left navigation plane, click Findings.

The Findings page appears, showing a table that lists your findings.
In the findings table, click the row for the finding for which you want to see details.
The Findings Details page appears.
(Optional) In the upper-right corner, turn on Include Info Severity to list findings with info-level severity. This option is off by default. For more information on severity level, see Vulnerability Severity Indicators.

The following tables describe the information that appears in each option:

Section	Description
Affected Application	Information about the affected application detected in the finding, including: Name — The name of the affected application. You can click the link in the name to view details about the affected application on the Web Application Asset Details page. First Seen — The date on which a scan first found the vulnerability on the affected application. Last Seen — The date on which a scan last found the vulnerability on the affected application.
Description	A description of the Tenable plugin that identified the vulnerability detected in the finding.
Solution	A brief summary of how you can remediate the vulnerability detected in the finding. Only appears if an official solution is available.
See Also	Links to external websites that contain helpful information about the vulnerability detected in the finding.
Vulnerability Properties	Information about the vulnerability that the plugin identified, including: Severity — The severity of the vulnerability. Exploitability — Characteristics of the vulnerability that factor into its potential exploitability. Exploited With — The most common ways that the vulnerability may be exploited. Vuln Published — The date when the vulnerability definition was first published (for example, the date that the CVE was published). Patch Published — The date on which the vendor published a patch for the vulnerability.
Discovery	Information about when Tenable Web App Scanning first discovered the vulnerability, including: First Seen — The date when a scan first found the vulnerability on an application. Last Seen — The date when a scan last found the vulnerability on an application. Age — The number of days since a scan first found the vulnerability on an application in your network.
VPR Key Drivers	VPR Key Drivers are the vulnerability and threat intelligence attributes that were significant factors in the calculation of the VPR: Threat Intensity — The threat intensity based on the number and frequency of threat events (e.g., vulnerability and exploit activity on social media and the dark web) observed in recent weeks. Exploit Code Maturity — Based on the availability of exploit code in various databases and frameworks such as Reversinglabs, Exploit-db, Metasploit, Canvas etc. Age of Vulnerability — Number of days since the vulnerability was published on NVD. Product Coverage — The relative number (low, medium, high, or very high) of unique products affected by the vulnerability. CVSSv3 Impact Score — Impact Score provided by NVD or predicted by Tenable. Threat Sources — A list of all sources (e.g., social media, dark web, etc.) where threat events (vulnerability and exploit activity) were observed in recent weeks.
Plugin Details	Information about the plugin that detected the vulnerability detected in the finding, including: Plugin ID — The ID of the plugin that identified the vulnerability. Publication Date — The date on which the plugin that identified the vulnerability was published. Modification Date — The date on which the plugin was last modified. Family — The family of the plugin that identified the vulnerability. Severity — The severity of the plugin that identified the vulnerability.
Risk Information	Information about the relative risk that the vulnerability presents to the affected asset, including: Risk Factor — The CVSS-based risk factor associated with the plugin. Risk Modified — Indicates any action applied to modify the risk for the plugin. Can be Accept or Recast. CVSS3 Base Score — The CVSSv3 base score (intrinsic and fundamental characteristics of a vulnerability that are constant over time and user environments). CVSS3 Vector — More CVSSv3 metrics for the vulnerability. CVSS2 Base Score — The CVSSv2 base score (intrinsic and fundamental characteristics of a vulnerability that are constant over time and user environments). CVSS2 Vector — More CVSSv2 metrics for the vulnerability.
Reference Information	A list of references to third-party information about the vulnerability, exploit, or update associated with the plugin.