View Findings Details

Information about the affected application detected in the finding, including:

• Name — The name of the affected application. You can click the link in the name to view details about the affected application on the Web Application Asset Details page.

• First Seen — The date on which a scan first found the vulnerability on the affected application.

• Last Seen — The date on which a scan last found the vulnerability on the affected application.

A description of the Tenable plugin that identified the vulnerability detected in the finding.

A brief summary of how you can remediate the vulnerability detected in the finding. Only appears if an official solution is available.

Information about the vulnerability that the plugin identified, including:

• Severity — The severity of the vulnerability.

• Exploitability — Characteristics of the vulnerability that factor into its potential exploitability.

• Exploited With — The most common ways that the vulnerability may be exploited.

• Vuln Published — The date when the vulnerability definition was first published (for example, the date that the CVE was published).
• Patch Published — The date on which the vendor published a patch for the vulnerability.

Information about when Tenable Web App Scanning first discovered the vulnerability, including:

• First Seen — The date when a scan first found the vulnerability on an application.

• Last Seen — The date when a scan last found the vulnerability on an application.

• Age — The number of days since a scan first found the vulnerability on an application in your network.

VPR Key Drivers are the vulnerability and threat intelligence attributes that were significant factors in the calculation of the VPR:

• Threat Intensity — The threat intensity based on the number and frequency of threat events (e.g., vulnerability and exploit activity on social media and the dark web) observed in recent weeks.

• Exploit Code Maturity — Based on the availability of exploit code in various databases and frameworks such as Reversinglabs, Exploit-db, Metasploit, Canvas etc.

• Age of Vulnerability — Number of days since the vulnerability was published on NVD.

• Product Coverage — The relative number (low, medium, high, or very high) of unique products affected by the vulnerability.

• CVSSv3 Impact Score — Impact Score provided by NVD or predicted by Tenable.

• Threat Sources — A list of all sources (e.g., social media, dark web, etc.) where threat events (vulnerability and exploit activity) were observed in recent weeks.

Information about the plugin that detected the vulnerability detected in the finding, including:

• Plugin ID — The ID of the plugin that identified the vulnerability.

• Publication Date — The date on which the plugin that identified the vulnerability was published.

• Modification Date — The date on which the plugin was last modified.

• Family — The family of the plugin that identified the vulnerability.

• Severity — The severity of the plugin that identified the vulnerability.

Information about the relative risk that the vulnerability presents to the affected asset, including:

Note: Some CVSS score types may not be available for a particular plugin ID.

• Risk Factor — The CVSS-based risk factor associated with the plugin.

• Risk Modified — Indicates any action applied to modify the risk for the plugin. Can be Accept or Recast.

• CVSSV4 Base Score — Intrinsic and fundamental characteristics of a vulnerability that are constant over time and user environments.

• CVSSV4 Vector — More CVSSv4 metrics for the vulnerability.

• CVSS3 Base Score — The CVSSv3 base score (intrinsic and fundamental characteristics of a vulnerability that are constant over time and user environments).

• CVSS3 Vector — More CVSSv3 metrics for the vulnerability.

• CVSS2 Base Score — The CVSSv2 base score (intrinsic and fundamental characteristics of a vulnerability that are constant over time and user environments).

• CVSS2 Vector — More CVSSv2 metrics for the vulnerability.