ext.vulnerability-1.0.xsd Maven / Gradle / Ivy
Go to download
Show more of this group Show more artifacts with this name
Show all versions of cyclonedx-core-java Show documentation
Show all versions of cyclonedx-core-java Show documentation
The CycloneDX core module provides a model representation of the BOM along with utilities to assist in creating, parsing, and validating BOMs.
CycloneDX Vulnerability Extension
https://cyclonedx.org/ext/vulnerability
Apache License, Version 2.0
Textual representation of the severity of the vulnerability adopted by the risk analysis method.
If an other risk analysis method is used other than whats defined in scoreSourceType,
the user is expected to translate appropriately to match with an element value below.
Numerical representation of the vulnerability score.
Must be a number between 0 - 10 (maps to lowest severity - highest severity)
Specifies the risk scoring methodology/standard used.
The rating is based on CVSS v2 standard
https://www.first.org/cvss/v2/guide
The rating is based on CVSS v3 standard
https://www.first.org/cvss/v3.1/specification-document
The rating is based on OWASP Risk Rating
https://www.owasp.org/index.php/OWASP_Risk_Rating_Methodology
The rating is based on Open FAIR specification
http://www.opengroup.org/subjectareas/security/risk
Use this if the risk scoring methodology is not based on any of the options above
Defines the numerical risk score of a vulnerability
The base score of the security vulnerability (Refer CVSS standard for example)
The impact subscore of the security vulnerability (Refer CVSS standard for example)
The exploitability subscore of the security vulnerability (Refer CVSS standard for
example)
Textual representation of the metric values used to score the vulnerability
see attack vector in https://www.first.org/cvss/v3.1/specification-document
Defines the structure of a vulnerability.
The id of the vulnerability as defined by the risk scoring methodology
For example CVE-2019-15842 (of https://nvd.nist.gov/vuln/detail/CVE-2019-15842)
The source of the vulnerability where it is documented.
Usually the name of the organization publishing vulnerability information
The url of the vulnerability documentation as provided by the source
For example https://nvd.nist.gov/vuln/detail/CVE-2019-15842
The name of the source. For example "National Vulnerability Database"
List of the vulnerability ratings as defined by various risk rating methodologies.
List of Common Weaknesses Enumerations (CWEs) codes that describes this vulnerability.
For example 399 (of https://cwe.mitre.org/data/definitions/399.html)
Description of the vulnerability as provided by the source organization
The remediation options for the vulnerability if available
A recommendation of how the particular vulnerability can be avoided/mitigated.
Published advisories of the vulnerability if provided
References a component by the components bom-ref attribute
Defines a list of vulnerabilities.
Vulnerabilities are intended to be used inside the BOM component element.
Extending a component ability to declare associated vulnerability information.
Each component element optionally can add a vulnerabilities element.